Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
265
questions with no upvoted or accepted answers
6
votes
1
answer
988
views
What is the preferred way of using AWS (specifically S3) from mobile apps?
Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
- 161
5
votes
1
answer
389
views
Google CSP Evaluator and style-src 'unsafe-inline'
Google provides a CSP evaluator to validate if a given content-security policy is well set up (github, validator). However, if one uses 'unsafe-inline' in the style-src directive this is reported as '...
- 51
5
votes
0
answers
137
views
Arbitrary methods directly callable with Front Controller pattern
I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern.
One of the potential problems I'm thinking about is that with a ...
- 441
4
votes
1
answer
823
views
How to securely store 3rd party API keys directly on web server
I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
- 41
4
votes
3
answers
484
views
Web Application Firewall using web app source code analysis
I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks.
We know each web application has a number of input ...
- 67
4
votes
1
answer
806
views
Exploit user input being directly inserted into PDF
I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.
The user input is accepted as is, without encoding or any other modification. This ...
- 159
3
votes
0
answers
315
views
Should you terminate a session when an incorrect CSRF token is submitted?
According to the OWASP CSRF Prevention Guide if the server fails to
...verify the existence and validity of the token in the request
compared to the token found in the user session ... then the ...
- 31
3
votes
0
answers
638
views
Exploiting LFI with prefix in PHP?
I have a scenario as the following:
<?php include("resource/" + $_GET['vuln']); ?>
And I'm trying to get RCE from this, or atleast acquire some interesting information.
I already looked at /...
- 143
3
votes
1
answer
684
views
XSS chained with CSRF = Stored XSS?
I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense.
I would say that it can stand true, ...
- 111
3
votes
0
answers
103
views
How to add a new webauthn key if the existing one isn't portable
Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
- 131
3
votes
0
answers
2k
views
How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?
Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
a browser game in which the player's level and progress are to be saved locally.
a game,...
- 131
3
votes
0
answers
98
views
Are environmental variables for web PaaS a bad security smell?
I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis
Assuming this has been done to follow good ...
- 319
3
votes
0
answers
119
views
Is it safe to show a session activity summary after logout?
As noted in DBS' internet banking system, it shows a summary after I clicked logout. It gives an activity log performed during the session. Which I thought, during the logout process, the current ...
- 31
3
votes
1
answer
670
views
Developping an authentication system between client, server, and CouchDB database
I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
- 131
3
votes
0
answers
413
views
How to remember the trusted machine in an application
We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
- 31
2
votes
3
answers
239
views
Reason to create fake accounts using real email addresses
I've been dealing with a problem that I can't solve until I find the cause.
We get regularly accounts made with scraped/leaked emails and random names. They are useless because you need to verify the ...
- 121
2
votes
1
answer
168
views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
- 21
2
votes
3
answers
509
views
Is OAuth more secure compared to API Keys
I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls:
Using API Keys
For example inside Hubspot integration I use this web call to get all the ...
2
votes
1
answer
258
views
Dangers of using the web applications provided by password managers
The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
- 51
2
votes
1
answer
338
views
Blind SQL Injection
I am participating in a program that when I write in the url parameter ' or 1=1;-- it gives me Forbidden 403 and when I write in the parameter ' or 1=2;-- it shows me the page.
Is the website and ...
- 31
2
votes
4
answers
424
views
LFI php://input returning initial argument?
TLDR: Trying to execute commands on site thats got a LFI vuln.
So I am making my post request to my vulnerable site and
import requests
header = {
'User-Agent':'Mozilla/5.0 (Windows; U; ...
- 21
2
votes
0
answers
611
views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
- 21
2
votes
0
answers
127
views
PDF Documents - Browser View 2020
I posted a question yesterday about PDF files in a browser that can be found here. There you can find more information about dealing with PDF documents in browser.
My question here is how each ...
- 299
2
votes
1
answer
210
views
What is the recommended way to generate API tokens using Laravel framework?
I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
- 29
2
votes
1
answer
128
views
Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?
I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
- 121
2
votes
0
answers
86
views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
- 1,442
2
votes
1
answer
845
views
Is it possible to launch XSS if only the left angle bracket is encoded
I find some website only encode the left angle bracket of inserted HTML tag, for example:
<div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
- 685
2
votes
0
answers
159
views
How to defend against brute-force form submissions
(To be clear, in this question I'm not asking about how to protect a login form against brute-force attacks.)
I work for a company which designs and builds microsites for competitions that appear on ...
- 21
2
votes
0
answers
325
views
What is the best practice of CSRF/CORS for universal apps?
I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
- 121
2
votes
0
answers
221
views
What's the use of an "extra" dynamic declaration in an external DTD blind XXE attack?
I've been studying XXE attacks through portswigger blog.
I don't understand the extra step of a dynamic declaration (i.e. <!ENTITY % eval...) in the below external DTD:
<!ENTITY % file SYSTEM ...
- 1,177
2
votes
0
answers
310
views
Can we use cookie session id value in the body of the request?
A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
- 89
2
votes
0
answers
89
views
Does not using CAS when it's availible encourage phishing?
My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services.
However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
- 121
2
votes
0
answers
324
views
Persistent HTML form data across sessions
I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how.
UserA logs in
Fills form with custom data
Logs out before sending ...
- 159
2
votes
1
answer
624
views
Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?
For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER.
I wanted to find out if there are any benefits of placing WAF ...
- 21
2
votes
0
answers
156
views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
- 121
2
votes
0
answers
146
views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
- 65.1k
2
votes
0
answers
107
views
Burp Suite - Mark Issues as "Validated"
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
2
votes
0
answers
546
views
How to protect data at rest in a small web application where it’s hard to protect keys
A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL).
Often, the two are hosted on a single physical server or on a ...
- 199
2
votes
0
answers
94
views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
user185826
2
votes
1
answer
2k
views
Exfiltration through FTP using XXE on a Tomcat server
I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents:
Base XML (...
- 259
2
votes
0
answers
2k
views
Testing a padding oracle vulnerability with PadBuster
I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability
+ OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
- 21
2
votes
0
answers
1k
views
Data image with CSP
I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that.
Because it is called from within ...
- 93
2
votes
0
answers
179
views
How to make sure your API key cannot just be copied and used
One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
- 121
2
votes
0
answers
143
views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
- 773
2
votes
0
answers
609
views
Web app access control system design
I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC.
For the ...
- 161
2
votes
0
answers
179
views
How to securely manage generating files on the client-side to download
While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript:
using data URLs
by generating the file on ...
- 296
2
votes
0
answers
692
views
Microsoft IIS 7.5 from Time Based SQLi DBA to shell
I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.
My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
- 283
2
votes
0
answers
167
views
Throttling IPv6 requests - what would be a suitable subnet size?
I'm trying to come up with a request throttling policy for a web application based on IP addresses.
For throttling requests for users on IPv4, a subnet size of /32 (i.e. a single IP address) is often ...
user22260
2
votes
0
answers
201
views
Secure user logins in applications
We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
- 1,931
2
votes
0
answers
132
views
How to safely decrypt user data in scheduled script
I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password.
Upon request ...
- 53