Questions tagged [web]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
152
votes
5answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
76
votes
4answers
11k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
74
votes
10answers
12k views

Are security flaws acceptable if not much harm can derive from them?

Recently, I have discovered a security flaw in a business website. This website has a password-protected "Partners Area", and like many websites it provides a form to reset the user's password. When ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
57
votes
6answers
11k views

Why do some sites ask for username/email and password on two separate screens? [duplicate]

Well, I only have two examples, but it seems to be a slowly growing thing. First, I noticed that hotmail.com/live.com started to do this - ask for the email address on the first screen, and then you ...
51
votes
4answers
6k views

Why submit a website to plaintext offenders?

I've read this question and to quote from the accepted answer Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case. ...
50
votes
5answers
12k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
32
votes
3answers
7k views

How are short passwords not safe if you limit the number of attempts?

On all web services that require passwords, like gmail, you are asked to set a long password. Like 8 characters or more. The reason being higher security. But the same services limit the number of ...
24
votes
3answers
7k views

How to deal with WPE users

I own a chat room and some users use a program Winsock Packet Editor, "WPE PRO". With it they manage to bypass chat rules, like they can't be muted or kicked, and they can send messages fast ...
22
votes
5answers
9k views

Could hashing prevent SQL injection?

On a whim I've recently decided to throw up the first proper website I created onto my local web server I use for development. I thought it'd be a great environment to throw some SQL at for injection ...
16
votes
1answer
5k views

Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?

I understand JSON Hijacking vulnerabilities have been fixed in all modern browsers, but how exactly? There are many articles that talk about techniques to prevent JSON Hijacking attacks (i.e. ...
14
votes
1answer
2k views

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]

What parties have access to the full requested URL of a website accessed via the HTTPS protocol? Here are some possibilities I can think of, and there could be more: local device accessing the ...
13
votes
4answers
11k views

How to perform a proper DDoS test in a safe and controlled way?

What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure? What different types of DDoS attacks are there and what things should be considered performing such a ...
9
votes
1answer
543 views

Does HTTP/2 prevent security vulnerabilites like CRLF injection?

Which vulnerabilites does HTTP/2 prevent? More specifically: Does it prevent HTTP request smuggling? Does it prevent HTTP response splitting / CRLF injection?
7
votes
2answers
2k views

Serving a php webshell without running it locally

I am using Kali Linux in a pentesting lab. By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file ...
6
votes
1answer
1k views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
6
votes
1answer
1k views

SSRF Attack Exploitation Scenario

In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability? ...
6
votes
1answer
5k views

How to test the validity of DNSSEC from a command line interface?

I am doing a research project on The Domain Name System Security Extensions (DNSSEC). I have a SOA, Stub resolver and a client as well as a attack machine. My question is this. Is there a way to ...
5
votes
4answers
331 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
5
votes
2answers
606 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
5
votes
1answer
603 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
5
votes
1answer
658 views

Equifax Data Breach 2017

In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced. How did the criminals access this data? What was the exploit?
5
votes
0answers
95 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
4
votes
3answers
2k views

Is hijacking a webcam after visiting a website a plausible threat?

(I made a throwaway to ask this question, since this situation is pretty embarrassing) Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless ...
4
votes
4answers
455 views

Are limited length passwords a security risk? [duplicate]

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters. Is that a security risk?
4
votes
2answers
338 views

Telegram (or other messenger) message as second factor in 2FA

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
4
votes
1answer
11k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
4
votes
1answer
3k views

Breaking JS String XSS

I've been searching for XSS vulnerabilities in a friend's website (blackbox) and in one of the pages he takes your input and puts it inside a js script, window.location="[INPUT]"; I couldn't break ...
4
votes
1answer
252 views

How can I see whether the e-mails I exchanged with someone have been encrypted?

In my understanding (please correct if applicable), The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote ...
4
votes
1answer
317 views

How to automate sending messages about abused internet hosts

I have just looked into the error logs of our web server and I have observed a great increase of SQL injection attacks this year. Those attacks, more than 3000 in 2016, usually look like this: ...
4
votes
1answer
539 views

Best practice regarding activation mail request to reduce information leaks

We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her ...
3
votes
3answers
364 views

How to make sure that no one is watching you through webcam?

I have heard that intelligence agencies and hackers can illicitly gain access to a computer's webcam and microphone and keep a close eye on people using suspicious programs or malware. Is there any ...
3
votes
1answer
821 views

Why Same origin policy is based on host-name and not on IP?

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows. An origin is defineed as ...
3
votes
1answer
132 views

Popular website contains ad that triggers remote scan from botnet: what should I do?

One of my country's main TV channel has a website from which one can watch it live - in streaming. Obviously, it serves ads in the meanwhile, mainly from google partners. One night I had the website ...
3
votes
1answer
465 views

Can Javascript overwrite a HTTPOnly cookie?

Can Javascript overwrite or delete a HTTPOnly cookie? In more detail: Suppose the user's browser has a cookie for example.com with the HTTPOnly flag set, say session=552..e0. Suppose the user visits ...
3
votes
1answer
2k views

How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?

Quote from Activating CleanBrowsing Activating CleanBrowsing is pretty simple and only takes 5 minutes. We do our work via DNS, so you have to switch your DNS servers to go through our Network ...
3
votes
1answer
111 views

Is it really necessary for security to have login on separate page?

Working on a public website where the login form is located on a separate page on it's own subdomain. One of our biggest goals at the moment is to try to promote users to log in to the site more ...
3
votes
1answer
96 views

Should users be able to update their avatar using URL instead of uploading a file?

I am building a web application where a user can update his avatar by uploading a picture from his computer file directory. Here's how I implemented it: <input id="profile_pic" class="avatar-...
3
votes
0answers
1k views

can I use whatsapp like gmail with login and password? without everytime scan code? [closed]

can I use whats app like gmail with login and password? without every time scan code? Because I need whats app some time different computer. so, it is possible to make id and password to use whats ...
2
votes
1answer
2k views

HTTPS green bar loads then goes away

I have properly configured SSL, and it loads pages when you put HTTPS. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The ...
2
votes
1answer
4k views

Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...
2
votes
1answer
110 views

Can someone perform DDoS on my VPS even if it is only accessible through SSH?

Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
2
votes
1answer
281 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
2
votes
1answer
196 views

What is the purpose of this cookie?

I have a site. My site does not have any cookies. It is developed with Drupal 8(CMS) and have few articles. Just for a curiosity I did check whether my website uses cookies or not. I did use Firefox ...
2
votes
3answers
114 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
2
votes
1answer
71 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): /0xD805A9E4///RLI=590-UI=273411771-OI=6313-...
2
votes
2answers
333 views

Is it ok to send plain text credentials in a XHR GET request?

When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
2
votes
1answer
747 views

Does an Embedded Content Security Policy (CSP) Enforcement ruin a “regular” CSP?

I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP). This document defines a mechanism by which a web page can embed a nested browsing context if ...
2
votes
3answers
3k views

What does the POST data of HackBar (Firefox add-on) do?

What does the POST DATA Feature of Hackbar (Addon of Firefox )do ? If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ? If I want to repeat the same thing ...
2
votes
1answer
120 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...