Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-service]

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

0
votes
0answers
16 views

Why would someone practically want access to a JSP servlet source?

I've seen online now a few times ways to exploit web servers like httpd using connectors like tomcat to expose the source code for a .jsp file when it is not supposed to. For example, appending %01 ...
1
vote
1answer
38 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
0
votes
2answers
72 views

Web App or Web Services testing?

I am trying to clear up a doubt on security testing. If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
1
vote
0answers
83 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
0
votes
0answers
61 views

javax.xml.* XXE Exploitation

During a pentest engagement, I found an XXE vulnerability on a SOAP webservice written in Java, OS is Windows Server and I'm trying to demonastrate how serious the vulnerability is. The problem is, I ...
0
votes
0answers
22 views

How to let any number of external servers securely register to receive updates from my own server

My scenario is as follows: On one side I have a single server running an application, which I control fully. On the other, there can be any number of other servers that have to connect to my server ...
4
votes
3answers
189 views

What benefit do Captchas provide?

I have researched and found the following sites which will break captchas: anticaptcha 2captcha (links not included to prevent promoting the sites) Given that these services can be used to break ...
0
votes
0answers
38 views

What is the best way to track a logged in user?

We have a client/server app where the client is the browser running our JavaScript app and the server side is an ASP.NET app presenting a RESTful API. We presently have 1 instance of the server, but ...
1
vote
1answer
53 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
4
votes
3answers
142 views

Are there security concerns when using popular (js) frameworks?

To what extent should one trust web/js frameworks? Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be ...
1
vote
1answer
58 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
-1
votes
1answer
75 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
1
vote
1answer
182 views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...
0
votes
3answers
228 views

Is “Please update/confirm your email address” actually helpful?

Steam just asked me "Is this still your email address? [email_address_here]" This is an on-PC app that I trust, so I'm 100% confident of its legitimacy. I would like to know about its usefulness. ...
1
vote
2answers
144 views

Web Service Authentication Using PBKDF2 and a Public Salt - Does the salt need to change on every request?

I have implemented PBKDF2 authentication for some web services. The client is given the following information, so they can duplicate the PBKDF2 function: the hashing algorithm (SHA256) a secret ...
38
votes
4answers
8k views

What does the tilde (~) mean at the end of a file extension? [closed]

While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index....
3
votes
2answers
2k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
2
votes
2answers
117 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
0
votes
0answers
22 views

XML structural testing from security perspective

I need to do XML structural testing from security perspective. The motive is to test the my web service/API is not vulnerable to and safe from XML structural attacks. Also, how the testing different ...
2
votes
1answer
613 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
0
votes
0answers
19 views

WS Security DTD Tag in XML message

I am testing web service with the message that contains XML Bomb in DOCTYPE declaration. The attack is not possible because web service returns message: <faultstring>The parser has encountered ...
3
votes
2answers
253 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
2
votes
2answers
51 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
4
votes
1answer
236 views

Is using online SQL prettifiers considered safe?

From time to time when debugging SQL queries, we use online SQL prettifiers (e.g. this one) that reindent and properly format the queries to increase readability. Can this potentially be a source of ...
0
votes
1answer
65 views

Sending server side credentials as plaintext after connecting to SSL [duplicate]

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice? The application ...
13
votes
10answers
6k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
4
votes
2answers
1k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
6
votes
1answer
417 views

Understanding CSRF attack prevention

I've read multiple topics about web-specific attacks and preventions, but I'm still not sure if I got the point. Let's imagine that we have a website (myapp.com) and a web service (myapi.com). The ...
0
votes
2answers
201 views

Are JSON web services vulnerable to CORF attacks?

Is a web service vulnerable to CSRF attack if the following are true? GET/OPTIONS Requests are Rejected Token is used for Authentication, Without token we cant access the application Access-...
1
vote
1answer
53 views

Security difference between web tokens and message signing

I'm seeing two different types of authentication being widely used, with one being far more complex than the other. One are the simple session ID tokens used in most websites (user sends login info, ...
2
votes
1answer
96 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
0
votes
1answer
277 views

How exploitable is a QR code in a login system?

I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be ...
0
votes
3answers
755 views

What is untrusted data

I was reading the basics of XSS prevention on owasp xss rules. But the issue is rather abstract. The term "untrusted data" is often used. Every rule reminds not to insert untrasted data in the certain ...
1
vote
2answers
78 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
0
votes
2answers
148 views

Does CVE-2017-8759 impact the web service?

I saw lots of information on the impact to end user PC, but didn't see anywhere explain the impact to the cloud service. If the issue is from the SOAP WSDL parsing, seems like the web service can also ...
0
votes
0answers
47 views

Sending sensitive param to public API?

I need to modify a publicly-accessible REST API - unsecured, all HTTP GETs, access (theoretically) limited by API keys. I need one of the endpoints to now accept an additional parameter - one that's ...
1
vote
2answers
144 views

User name and password is passed in custom headers

Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https. How is it different from using from Authorization header. Which ...
1
vote
2answers
70 views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
0
votes
2answers
123 views

How do online banking applications work? [closed]

It's suprisingly hard to find concrete information about that topic. I've worked with the Flask framework lately and I just managed to create a proper login that stores the passwords in a database ...
0
votes
1answer
59 views

SSL cert securing an on-premises web service where the domain is hosted externally

We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently ...
2
votes
2answers
124 views

Should one encrypt traffic even when using HTTPS? [duplicate]

I took a look at google and here and I coudn't find the answer to this question: Let's say that I have a Webservice and an Android app. They communicate over HTTPS. Should I encrypt traffic or I can ...
0
votes
0answers
45 views

Time aware token on WS security (WSSE)

I'm creating a SOAP server with WSSE. As the specification suggest (https://www.oasis-open.org/committees/download.php/13392/wss-v1.1-spec-pr-UsernameTokenProfile-01.htm), my client needs to pass a ...
0
votes
1answer
605 views

What is an “appropriate” request size limit for a web service?

Point 18.4 of the OWASP ASVS says Verify that all input is limited to an appropriate size limit. Currently i have an input limit of 50MB on all web services. (And it seems like this is the ...
3
votes
1answer
136 views

Security implications of a missing SCSV, but with only TLS 1.2 allowed

Similar to this security stackexchange question, I was wondering if there's any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite ...
0
votes
1answer
83 views

Security considerations when opening port for a service?

I would like to host a service (written in C#) on my server and allow it to be accessed from outside the network. I know that I need to open a port in the firewall for this to work, and I managed to ...
0
votes
2answers
819 views

Sending encrypted data through android app

I have an SDK for my web app, which user can integrate into his android app. For authentication, we have an authkey. And it is sent as a POST or GET parameter when server-to-server communication ...
0
votes
2answers
164 views

I can send an email from your email account without your permission. How is this possible? [duplicate]

Similar question with an amazing answer: How can PayPal spoof emails so easily to say it comes from someone else? I hope that the title to this question is actually a lie... but, to my knowleage, I ...
4
votes
4answers
1k views

Detecting Tor Browser using SIEM

I'm looking for a possible way to identify Tor Browser activity using QRadar. We have Firewall integrated & IPS (Without Application Control. Hence not a possible option). I went through the link ...
1
vote
1answer
41 views

Would a custom random string do what I want?

Upfront, please overlook my naivety. I have a service app that talks to a web api. I only want the service to talk to the web api, nothing else. Means I need to secure it and I'm trying to understand ...