Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

261 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
2 answers
14k views

What are the risks of using TLS 1.0 for web applications?

I work with a company that has several web applications available to its customers via HTTPS. Recently, client browsers will not access these web applications due to the HTTPS connection being made ...
user avatar
  • 2,022
5 votes
1 answer
948 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
user avatar
5 votes
0 answers
136 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
user avatar
  • 433
4 votes
1 answer
732 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
user avatar
4 votes
3 answers
466 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
user avatar
  • 67
4 votes
1 answer
725 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
user avatar
3 votes
0 answers
248 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
user avatar
  • 31
3 votes
1 answer
202 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
user avatar
  • 43
3 votes
2 answers
246 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
user avatar
3 votes
0 answers
102 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
user avatar
3 votes
0 answers
2k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
user avatar
  • 131
3 votes
0 answers
95 views

Are environmental variables for web PaaS a bad security smell?

I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis Assuming this has been done to follow good ...
user avatar
3 votes
0 answers
119 views

Is it safe to show a session activity summary after logout?

As noted in DBS' internet banking system, it shows a summary after I clicked logout. It gives an activity log performed during the session. Which I thought, during the logout process, the current ...
user avatar
3 votes
0 answers
330 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
user avatar
2 votes
1 answer
197 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
user avatar
  • 21
2 votes
4 answers
242 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
user avatar
  • 21
2 votes
0 answers
554 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
user avatar
  • 21
2 votes
1 answer
161 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
user avatar
2 votes
1 answer
424 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
user avatar
2 votes
0 answers
118 views

PDF Documents - Browser View 2020

I posted a question yesterday about PDF files in a browser that can be found here. There you can find more information about dealing with PDF documents in browser. My question here is how each ...
user avatar
2 votes
0 answers
505 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
user avatar
  • 133
2 votes
1 answer
520 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
user avatar
  • 101
2 votes
0 answers
82 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
user avatar
2 votes
1 answer
596 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
user avatar
  • 665
2 votes
0 answers
135 views

How to defend against brute-force form submissions

(To be clear, in this question I'm not asking about how to protect a login form against brute-force attacks.) I work for a company which designs and builds microsites for competitions that appear on ...
user avatar
2 votes
0 answers
277 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
user avatar
  • 121
2 votes
0 answers
195 views

What's the use of an "extra" dynamic declaration in an external DTD blind XXE attack?

I've been studying XXE attacks through portswigger blog. I don't understand the extra step of a dynamic declaration (i.e. <!ENTITY % eval...) in the below external DTD: <!ENTITY % file SYSTEM ...
user avatar
  • 1,087
2 votes
0 answers
153 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
user avatar
2 votes
0 answers
89 views

Does not using CAS when it's availible encourage phishing?

My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services. However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
user avatar
  • 121
2 votes
0 answers
282 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
user avatar
2 votes
0 answers
142 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
user avatar
  • 121
2 votes
0 answers
141 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
user avatar
  • 64.2k
2 votes
0 answers
100 views

Burp Suite - Mark Issues as "Validated"

After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
user avatar
2 votes
0 answers
510 views

How to protect data at rest in a small web application where it’s hard to protect keys

A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL). Often, the two are hosted on a single physical server or on a ...
user avatar
  • 199
2 votes
0 answers
94 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
user avatar
  • 153
2 votes
0 answers
2k views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
user avatar
2 votes
0 answers
1k views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
user avatar
2 votes
0 answers
163 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
user avatar
2 votes
0 answers
123 views

User has been authenticated. Now what?

I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net. Not wanting to ...
user avatar
  • 773
2 votes
0 answers
593 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
user avatar
2 votes
0 answers
156 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
user avatar
2 votes
0 answers
619 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
user avatar
  • 121
2 votes
2 answers
250 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with an LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in Linux behave like a file or ...
user avatar
  • 21
2 votes
0 answers
659 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
user avatar
  • 273
2 votes
0 answers
159 views

Throttling IPv6 requests - what would be a suitable subnet size?

I'm trying to come up with a request throttling policy for a web application based on IP addresses. For throttling requests for users on IPv4, a subnet size of /32 (i.e. a single IP address) is often ...
user avatar
2 votes
0 answers
199 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
user avatar
2 votes
0 answers
129 views

How to safely decrypt user data in scheduled script

I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password. Upon request ...
user avatar
2 votes
0 answers
191 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
user avatar
2 votes
0 answers
472 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
user avatar
  • 21
2 votes
0 answers
1k views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
user avatar

1
2 3 4 5 6