We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [web]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
152
votes
5answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
74
votes
10answers
12k views

Are security flaws acceptable if not much harm can derive from them?

Recently, I have discovered a security flaw in a business website. This website has a password-protected "Partners Area", and like many websites it provides a form to reset the user's password. When ...
74
votes
4answers
11k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
56
votes
6answers
10k views

Why do some sites ask for username/email and password on two separate screens? [duplicate]

Well, I only have two examples, but it seems to be a slowly growing thing. First, I noticed that hotmail.com/live.com started to do this - ask for the email address on the first screen, and then you ...
52
votes
4answers
6k views

Why submit a website to plaintext offenders?

I've read this question and to quote from the accepted answer Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case. ...
50
votes
5answers
11k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
24
votes
3answers
6k views

How to deal with WPE users

I own a chat room and some users use a program Winsock Packet Editor, "WPE PRO". With it they manage to bypass chat rules, like they can't be muted or kicked, and they can send messages fast ...
22
votes
5answers
8k views

Could hashing prevent SQL injection?

On a whim I've recently decided to throw up the first proper website I created onto my local web server I use for development. I thought it'd be a great environment to throw some SQL at for injection ...
14
votes
1answer
2k views

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]

What parties have access to the full requested URL of a website accessed via the HTTPS protocol? Here are some possibilities I can think of, and there could be more: local device accessing the ...
13
votes
4answers
10k views

How to perform a proper DDoS test in a safe and controlled way?

What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure? What different types of DDoS attacks are there and what things should be considered performing such a ...
12
votes
1answer
4k views

Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?

I understand JSON Hijacking vulnerabilities have been fixed in all modern browsers, but how exactly? There are many articles that talk about techniques to prevent JSON Hijacking attacks (i.e. ...
7
votes
2answers
1k views

Serving a php webshell without running it locally

I am using Kali Linux in a pentesting lab. By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file ...
6
votes
1answer
5k views

How to test the validity of DNSSEC from a command line interface?

I am doing a research project on The Domain Name System Security Extensions (DNSSEC). I have a SOA, Stub resolver and a client as well as a attack machine. My question is this. Is there a way to ...
5
votes
4answers
328 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
5
votes
1answer
871 views

SSRF Attack Exploitation Scenario

In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability? ...
5
votes
2answers
573 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
5
votes
1answer
650 views

Equifax Data Breach 2017

In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced. How did the criminals access this data? What was the exploit?
5
votes
0answers
45 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
4
votes
3answers
1k views

Is hijacking a webcam after visiting a website a plausible threat?

(I made a throwaway to ask this question, since this situation is pretty embarrassing) Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless ...
4
votes
4answers
442 views

Are limited length passwords a security risk? [duplicate]

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters. Is that a security risk?
4
votes
1answer
730 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
4
votes
2answers
214 views

Telegram (or other messenger) message as second factor in 2FA

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
4
votes
1answer
457 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
4
votes
1answer
248 views

How can I see whether the e-mails I exchanged with someone have been encrypted?

In my understanding (please correct if applicable), The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote ...
4
votes
1answer
315 views

How to automate sending messages about abused internet hosts

I have just looked into the error logs of our web server and I have observed a great increase of SQL injection attacks this year. Those attacks, more than 3000 in 2016, usually look like this: ...
4
votes
1answer
453 views

Best practice regarding activation mail request to reduce information leaks

We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her ...
3
votes
1answer
589 views

Why Same origin policy is based on host-name and not on IP?

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows. An origin is defineed as ...
3
votes
1answer
8k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
3
votes
1answer
122 views

Popular website contains ad that triggers remote scan from botnet: what should I do?

One of my country's main TV channel has a website from which one can watch it live - in streaming. Obviously, it serves ads in the meanwhile, mainly from google partners. One night I had the website ...
3
votes
1answer
2k views

How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?

Quote from Activating CleanBrowsing Activating CleanBrowsing is pretty simple and only takes 5 minutes. We do our work via DNS, so you have to switch your DNS servers to go through our Network ...
3
votes
1answer
2k views

Breaking JS String XSS

I've been searching for XSS vulnerabilities in a friend's website (blackbox) and in one of the pages he takes your input and puts it inside a js script, window.location="[INPUT]"; I couldn't break ...
3
votes
1answer
108 views

Is it really necessary for security to have login on separate page?

Working on a public website where the login form is located on a separate page on it's own subdomain. One of our biggest goals at the moment is to try to promote users to log in to the site more ...
3
votes
1answer
96 views

Should users be able to update their avatar using URL instead of uploading a file?

I am building a web application where a user can update his avatar by uploading a picture from his computer file directory. Here's how I implemented it: <input id="profile_pic" class="avatar-...
3
votes
0answers
1k views

can I use whatsapp like gmail with login and password? without everytime scan code? [closed]

can I use whats app like gmail with login and password? without every time scan code? Because I need whats app some time different computer. so, it is possible to make id and password to use whats ...
2
votes
1answer
2k views

HTTPS green bar loads then goes away

I have properly configured SSL, and it loads pages when you put HTTPS. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The ...
2
votes
1answer
766 views

Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...
2
votes
1answer
265 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
2
votes
1answer
185 views

What is the purpose of this cookie?

I have a site. My site does not have any cookies. It is developed with Drupal 8(CMS) and have few articles. Just for a curiosity I did check whether my website uses cookies or not. I did use Firefox ...
2
votes
3answers
114 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
2
votes
1answer
65 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): /0xD805A9E4///RLI=590-UI=273411771-OI=6313-...
2
votes
2answers
121 views

Is it ok to send plain text credentials in a XHR GET request?

When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
2
votes
1answer
533 views

Does an Embedded Content Security Policy (CSP) Enforcement ruin a “regular” CSP?

I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP). This document defines a mechanism by which a web page can embed a nested browsing context if ...
2
votes
3answers
3k views

What does the POST data of HackBar (Firefox add-on) do?

What does the POST DATA Feature of Hackbar (Addon of Firefox )do ? If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ? If I want to repeat the same thing ...
2
votes
1answer
114 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
2
votes
1answer
48 views

Load balancer haproxy [closed]

can i configure a load balancer between two nodes by using only two ip adresses. I mean one of the two server will be a load balancer and backend server in the same time
2
votes
2answers
1k views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
2
votes
1answer
271 views

Getting and then distributing a wildcard SSL certificate — is this okay?

I have a stupid/crazy idea that I wanted to ask about here. It's probably not going to work, but I'm curious. Browser security won't allow insecure web sockets (ws://) from secure (https://) pages ...
2
votes
1answer
349 views

Extracting as much information from a browser request as possible?

I am currently working on project that involves identifying spammers who are creating fake accounts on my site. I am interested to know what type of information I would be able to extract. First of ...
2
votes
1answer
353 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...