Questions tagged [web]

The tag has no usage guidance.

28 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
95 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
2
votes
0answers
32 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
2
votes
0answers
251 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
2
votes
0answers
720 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
2
votes
0answers
1k views

Apache Web Server ETag Header Information Disclosure Weakness

How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
1
vote
0answers
99 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
1
vote
0answers
107 views

Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
0answers
104 views

Blocking URL brute-forcing on my server

Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole. for example: http://myapp.com/phpmyadmin http://...
1
vote
0answers
131 views

Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing

Someone requested my site's (Wordpress/Apache) 'includes' directory: 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" Noticing the 200 response, I hit ...
1
vote
0answers
35 views

How to know what version of extensions are used in joomla-web-site from user's point of view?

The problem is: I'm a user and I'm to find out what version of extensions(modules, plugins and components) are used on Joomla-site. In simple cases the version is already written,like here: ...
1
vote
0answers
410 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
1
vote
0answers
74 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
1
vote
0answers
328 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
1
vote
0answers
129 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
1
vote
0answers
487 views

Brute Forcing a aspx form using Hydra

I am trying to brute force a Login.aspx page. It has two text fields - txt_Username and txt_Password The form submit however looks like this: <input type="submit" name="btn_Login" value="Login" ...
1
vote
0answers
78 views

Detecting cloaking at the client side

According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
0
votes
0answers
52 views

Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?

http://hunger.hu/webgl.html WARNING: only visit this website, it you don't mind crashing your PC! so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
0
votes
1answer
70 views

How to securely transfer cookies between two domains?

Let's say you have a website https://example.org which is being decommissioned and redirected to https://example.net. Your users have a cookie on https://example.org which contains some authentication ...
0
votes
1answer
44 views

Redirection - Different Website from Different Computer

There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
0
votes
1answer
53 views

Making S3 objects viewable only for logged in users

As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
0
votes
2answers
68 views

Can a Slow Post HTTP attack be done from a single client?

Can a Slow Post HTTP attack be done from a single client? The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c Ports are 16-bit numbers,...
0
votes
1answer
128 views

Can my company track my web history when Opera VPN is active?

Today I brought my personal laptop to the office. My laptop connects to the personnel wi-fi automatically (not actual intranet). To mention, my work ID and password are needed to connect this network. ...
0
votes
0answers
335 views

Difference between gobuster and dirbuster in performance

The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
0
votes
0answers
29 views

Burpsuite Crawling - Display Function Location on Result

Is there is any way for me to display Burpsuite crawling result as Function Location? What i mean by function location is like for example: URL: x.com/functions/showdata Function Location: User > ...
0
votes
1answer
89 views

What Same Origin Policy related risks are there with static pages?

I am wondering what risks there are if you have static pages on the same host that don't trust each other. A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also ...
0
votes
0answers
67 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
0answers
41 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
0
votes
1answer
88 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...