Questions tagged [web]
The web tag has no usage guidance.
44
questions with no upvoted or accepted answers
5
votes
1
answer
956
views
XXE OOB Large File Extraction
Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
- 51
2
votes
0
answers
712
views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
- 431
2
votes
1
answer
178
views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
- 21
2
votes
0
answers
763
views
SQL injection possible with parameter that seems to only accept integers
a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer?
In my case, I already have the confirmation of this ...
- 21
2
votes
0
answers
959
views
Web API authentication with Kerberos
We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
- 121
2
votes
0
answers
2k
views
Apache Web Server ETag Header Information Disclosure Weakness
How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
- 121
1
vote
0
answers
93
views
Newsletter Spam Attack - Somehow by not directly attacking?
Our website(shopify website) has been getting a bot attack on our newsletter subscription form. Not sure if emails are real or not but there is some from gmail and hotmail etc or some from weird ...
- 11
1
vote
0
answers
288
views
How can I encrypt files securely in my website?
With Django, I'm doing a file transfer website. One use will upload a file and then the recipient will download the file.
I want to encrypt this file securely so that the encryption key is not stored ...
1
vote
0
answers
137
views
Banking site POST data obfuscated. Why?
I am logged in to my banking site and I see this kind of form POST data in the Developer tools of Chrome:
accountNo: removed for security reason
branchCode: removed for security reason
fromDate: ...
- 11
1
vote
0
answers
125
views
What is the value of no paste text boxes for bank web sites?
HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
- 151
1
vote
0
answers
105
views
Clicking from one site to a logged in site. Does it reveal your original site identity?
Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc).
Now let's say you ...
- 111
1
vote
0
answers
207
views
Web authentication, replay, nonce and KEK
I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server.
After a lot of reading it seems that a reasonable ...
1
vote
0
answers
197
views
Webpack chunk loading mechanism and safety
I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript
document.createElement("script") with script's src ...
- 111
1
vote
0
answers
111
views
Best practices for handling links in discussion posts
Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
- 389
1
vote
0
answers
483
views
What is meaning of setting port number to NULL in document.domain call?
Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned
The port number is checked separately by the browser. Any call to document.domain, including document....
- 165
1
vote
0
answers
806
views
Is it possible to bypass .htacess protection?
So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
- 11
1
vote
0
answers
329
views
Blocking URL brute-forcing on my server
Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole.
for example:
http://myapp.com/phpmyadmin
http://...
- 111
1
vote
0
answers
814
views
Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing
Someone requested my site's (Wordpress/Apache) 'includes' directory:
122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
Noticing the 200 response, I hit ...
- 111
1
vote
0
answers
94
views
How to know what version of extensions are used in joomla-web-site from user's point of view?
The problem is: I'm a user and I'm to find out what version of extensions(modules, plugins and components) are used on Joomla-site.
In simple cases the version is already written,like here:
...
- 123
1
vote
0
answers
1k
views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
- 13
1
vote
0
answers
184
views
How to determine if a website has been hijacked?
I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL.
I was surprised by this change, ...
- 3,144
1
vote
0
answers
820
views
How to find no of columns using sql injection
I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error:
OraOLEDB error '80004005'
ORA-01756: quoted ...
- 11
1
vote
0
answers
347
views
Webauthn and TLS channel binding
my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook?
TLS channel ...
- 101
1
vote
0
answers
1k
views
Brute Forcing a aspx form using Hydra
I am trying to brute force a Login.aspx page.
It has two text fields - txt_Username and txt_Password
The form submit however looks like this:
<input type="submit" name="btn_Login" value="Login" ...
- 11
1
vote
0
answers
173
views
Detecting cloaking at the client side
According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
2
answers
773
views
Does a web access token need to be encoded?
Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
- 111
0
votes
2
answers
38
views
Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?
I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
0
votes
0
answers
49
views
domain (active directory) machines accessible via web
I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www.
I only have the vague ...
- 101
0
votes
0
answers
63
views
Methods to look for when checking if a javascript program is making network requests
I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following:
XMLHttpRequest
fetch
$.ajax
axios....
- 101
0
votes
2
answers
148
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
0
answers
115
views
What type of token is this?
I started noticing this kind of token in a lot of CTF tasks from different authors:
eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk
The structure is as follows:
...
- 3
0
votes
0
answers
346
views
Flask URL Vulnerabilities
I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does ...
0
votes
0
answers
120
views
No UAC appearing for newly installed applications
Recently I have noticed that my system doesn't show the UAC prompt whenever I install some application from another source, I have UAC on and everything is working fine, I also have an administrator ...
- 1
0
votes
0
answers
109
views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
- 155
0
votes
0
answers
187
views
How is web cache poisoning possible?
There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com:
Reflected unkeyed headers:
If the ...
- 101
0
votes
0
answers
258
views
Can I skip "if" statement with chrome debugger or another javascript debugger?
I see this code in a bug bounty program
The code:
<!DOCTYPE html>
<html>
...
</html>
<script>
if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
- 73
0
votes
0
answers
156
views
Reaching directly the origin server (through http) should be considered a vulnerability if the webapp use cloudfront?
SCENARIO:
webapp X use clodufront distributions to serve its content.
It's possible to contact directly the origin server and get the content with the following steps:
modify /etc/hosts to add <...
- 567
0
votes
0
answers
145
views
Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?
http://hunger.hu/webgl.html
WARNING: only visit this website, it you don't mind crashing your PC!
so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
0
votes
1
answer
437
views
How to securely transfer cookies between two domains?
Let's say you have a website https://example.org which is being decommissioned and redirected to https://example.net.
Your users have a cookie on https://example.org which contains some authentication ...
0
votes
1
answer
405
views
Redirection - Different Website from Different Computer
There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
- 11
0
votes
0
answers
3k
views
Difference between gobuster and dirbuster in performance
The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
0
votes
0
answers
191
views
Web Site Access - Port Whitelisting
I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
0
answers
115
views
Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be.
Is it ...
- 101
0
votes
1
answer
199
views
Is it a risk running old modules on Apache?
I just saw that my hoster is running extremly old modules on Apache.
The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
user160241