Questions tagged [web-service]

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't intended to be directly shown in browser.

Filter by
Sorted by
Tagged with
1 vote
3 answers
119 views

is mTLS authentication alone considered secure for authentication

We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
ChrisBint's user avatar
  • 113
0 votes
0 answers
66 views

Is this web cache poisoning attempt correct?

So i've been trying to learn cache poisoning for a while and today i thought i finally found a vulnerable instance. Everything seems to be working even tho it doesn't. Like, 416 response is cached, ...
wrieed's user avatar
  • 1
1 vote
1 answer
41 views

Validation of input in REST endpoint to prevent script injection?

We have a web service to provide dicom modality worklist operations. We have a security concern about sanitizing the user inputs (especially for attributes like Study Description, Requested Procedure ...
Hemant's user avatar
  • 113
1 vote
2 answers
328 views

How do I create a Client Authentication Certificate without a domain signed by a commercial CA?

For sending soap messages to a webservice we need to include a client authentication certificate with these messages. Normally we simply created a self signed client auth. certificate (with as a ...
user2713516's user avatar
1 vote
1 answer
159 views

How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?

I understand that nothing is perfectly secured. If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
Maxfield's user avatar
  • 127
2 votes
2 answers
322 views

How can I prevent visitors from exposing their personal IP addresses to my server?

I'm running an Apache server on an Ubuntu EC2 instance for some online friends, but they don't want me to be able to identify them in real-life. The hosted webapps require login, so it'd be easy for ...
Drin's user avatar
  • 23
3 votes
1 answer
327 views

Are HTTP security headers only for web browsers?

There are some HTTP security headers in the world of cyber security of web applications. These are e.g.: X-Content-Type-Options X-Frame-Options Content-Security-Policy Referrer-Policy Strict-...
Hasan's user avatar
  • 529
1 vote
0 answers
59 views

How to inform the owner of a site about a vulnerability if there is no feedback form? [closed]

Recently, I noticed several resources that may be in danger, but I did not find a feedback form or email or another way to contact the owner and warn. How can I notify the owners? DoS seems to me a ...
dorianw91's user avatar
0 votes
0 answers
85 views

Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?

This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
Skaman Sam's user avatar
1 vote
1 answer
81 views

How does a device’s manufacturer’s webpage know that I just plugged in one of their products

I plugged in a wireless mouse receiver while browsing its manufacturer’s website. Browser settings that allowed sites access to USB devices were turned off. The manufacturer’s website, upon the ...
Egoless's user avatar
  • 25
0 votes
0 answers
2k views

XXE in SOAP request when WS requires WS-Security

I am trying to test XXE and SSRF in SOAP webservice. Let say that my request looks like this: <?xml version="1.0"?> <!DOCTYPE order [ <!ELEMENT foo ANY > <!ENTITY xxe ...
user187205's user avatar
  • 1,283
0 votes
2 answers
403 views

Windows IP Helper service listening on port 1000

On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
Liam Stojanovic's user avatar
0 votes
1 answer
95 views

How to know what IPs are associated with an authorised server?

My goal is to analyze the traffic of an Android application, to check if it contacts any IPs not associated with the server it is meant to contact. Using PCAPRemote I created a connection log file and ...
Momoa's user avatar
  • 1
0 votes
0 answers
82 views

What metadata could be stored in the IPFS network and what could be collected by modified nodes?

I'm guessing uploading to IPFS also uploads some metadata, which gets shared as well, does this assumption hold any truth? According to this only content identifiers and node identifiers are in the ...
Sir Muffington's user avatar
0 votes
2 answers
388 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
jhurtas's user avatar
  • 101
0 votes
1 answer
28 views

Does a hash-based storage cache design require additional access-control?

Please forgive the vagueness of the question title. I am currently working/designing an opaque storage of immutable files. The purpose of the service is simple: storing files and being able to ...
ereOn's user avatar
  • 134
0 votes
0 answers
100 views

Is using a developer key to protect a REST API good practice?

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments. I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
Andy Fusniak's user avatar
-2 votes
1 answer
388 views

Online service to download file from URL directly as zip [closed]

Is there an online service which allows to download a file from a URL directly zipped? I want to analyze a potential malicious JavaScript file with some automatic anti virus engines but I don't want ...
winklerrr's user avatar
  • 125
0 votes
0 answers
114 views

Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious

Backstory: I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about ...
I_Don't_Code's user avatar
0 votes
1 answer
99 views

Protect server-side key with client token

I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
Felipe's user avatar
  • 123
19 votes
2 answers
3k views

Why is CSRF protection only applicable to web services with browser clients? [duplicate]

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
hotmeatballsoup's user avatar
2 votes
1 answer
368 views

CORS configuration for service with single browser client

Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
hotmeatballsoup's user avatar
2 votes
1 answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
Arnold Rothstein's user avatar
1 vote
2 answers
226 views

Hacking attemps from unkown source

I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...
Sadmi's user avatar
  • 153
0 votes
1 answer
775 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
infinitieunique's user avatar
0 votes
2 answers
516 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
u9kV-6J's user avatar
  • 145
0 votes
1 answer
798 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
pstatix's user avatar
  • 111
2 votes
1 answer
270 views

Based on these HTTPS requests what type of attack is this?

I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
theoneandonly2's user avatar
1 vote
3 answers
413 views

Exposing different services on the same port

My current project contains multiple heterogeneous TCP servers, but our IT guys have clearly declared that they will give me only one 443 port, which is fair enough. Two options are on the table now. ...
user3427483's user avatar
1 vote
1 answer
108 views

Are there services to detect data breaches?

There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them? What about small data ...
Martin Thoma's user avatar
  • 3,914
2 votes
3 answers
862 views

Making S3 objects viewable only for logged in users

As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
ranban282's user avatar
0 votes
2 answers
166 views

Store cookies for multiple sites on remote server and connect from multiple clients

Would it be secure to: Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something) Login to the server with ...
Reed's user avatar
  • 105
2 votes
2 answers
2k views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
Pawan Dwivedee's user avatar
1 vote
0 answers
317 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
Paul's user avatar
  • 11
2 votes
1 answer
274 views

How long does a secret URL need to be?

I'm currently creating a small service where users can upload images (just a free time project). The images are either private, public (unlisted) or public (listed). Now I'm wondering for public ...
Martin Thoma's user avatar
  • 3,914
1 vote
0 answers
58 views

Abstract data access to user data in large-scale webservices

I am doing research on large-scale webservices and I am trying to understand what common techniques are to prevent user data being accidentally leaked to other logged in users. Especially where end-to-...
Daniel Stephens's user avatar
3 votes
2 answers
2k views

Is CSRF prevention logic required for api that is consumed only by mobile app?

I am developing an ASP.NET Core web api project whose only client will be a mobile app developed in Xamarin. There will be no web frontend for the application. Can CSRF attacks be executed if the ...
CristisS's user avatar
  • 133
14 votes
3 answers
2k views

Can the Host Header be used to hide the existence of a service?

Imagine a web server running on 93.184.216.34, usually reachable via the public DNS entry example.com. Web servers usually allow the distinction of multiple "virtual" servers, based on the Host header ...
user avatar
0 votes
1 answer
139 views

How do I restrict network access to websites using a monitoring system?

I am making a Java Project a LAB MONITORING SYSTEM for my University practical exams. Where a teacher or admin can monitor some selected computers and can give permissions to what the user at that ...
vishal rana's user avatar
3 votes
1 answer
146 views

SVC service page on production

I am testing web service on production. There is a standard SVC web page available like the example below (another randomly selected webpage, just for example). Is it ok to have this page available on ...
user187205's user avatar
  • 1,283
-1 votes
1 answer
134 views

My sql got attacked [closed]

I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries. The first thing that I did was to figure out if the ...
0xr00t's user avatar
  • 1
0 votes
1 answer
155 views

Got requests to unpublished services. Am I being spied on?

Just today I'm migrating some of my webpages to a new server. After a couple hours the services was ready, I set up a hosts file with my domain example.com pointing to the server address, went to my ...
Jassiel Díaz's user avatar
0 votes
0 answers
27 views

I've been an emailed a password; how can I proceed as securely as possible? [duplicate]

I am going through the on-boarding process for a summer internship with a well-known tech/bank company. I've received mail from HR requesting me to fill out an I-9 form via the external service they ...
D. Ben Knoble's user avatar
1 vote
2 answers
776 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
johannespartin's user avatar
1 vote
1 answer
1k views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
thesquaregroot's user avatar
1 vote
0 answers
94 views

How to authorize a subkey using a primary master key pair?

I'm using webcrypto, not PGP/GPG. I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
Xeoncross's user avatar
  • 313
1 vote
1 answer
278 views

Security Risk of outbound web calls [closed]

What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
P. Roe's user avatar
  • 111
2 votes
0 answers
111 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
Reiner Rottmann's user avatar
1 vote
1 answer
521 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
user187205's user avatar
  • 1,283
-1 votes
1 answer
111 views

How to protect my webserver from unauthorized client applications? [duplicate]

I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser). any person (even without registering) shold be able to access the webservices but ...
FuryFart's user avatar
  • 109

1
2 3 4 5
8