Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with web-application
Search options not deleted
user 121141
An application that is accessed over a network such as the Internet or an intranet using a browser.
11
votes
Poor error handling source code review
How are these related to security? According to my understanding it
seems like the above issues are code quality issues.
These are code quality issues. From the name, it looks like they are str …
- 3,951
0
votes
1
answer
234
views
Is there a vulnerability other than XSS which can result in client side script execution?
If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub- …
- 61.7k
1
vote
Public Digital Signature Validation with JWE
With JWS you can use one of the signature schemed supported. Broadly there are three options - HS, RS and PS - HMAC , RSA PKCS 1.5 and RSA PSS respectively.
The payload and protected headers would b …
- 3,951
1
vote
Testing web applications from an end user's perspective
If the session IDs are indeed encrypted due to HTTPS, are we still
able to determine if the session IDs are sufficiently random and
unpredictable? I was asking myself this question and for me, …
- 3,951
3
votes
1
answer
229
views
Can a user be redirected to a malicious website if only a part of the url can be controlled ...
I have a site located at
https://gooddomain.com/wonderful?returnPath=goodThings
which redirects me to
https://gooddomain.com/somegoodplace/goodThings
At the server side, the redirect is defined …
- 3,814
1
vote
0
answers
129
views
Is XSS possible when the user input gets reflected inside <textarea> when '<' and '>' symbol... [duplicate]
The scenario:
I have an application which takes user input and reflect everything to the following field in response.
<textarea rows="5" cols="32" name="test_name" tabindex="6">user input </textar …
- 65.8k
17
votes
How do you capture ALL the traffic from an Android app?
You are unable to intercept Facebook traffic because it uses SSL pinning.
On pen-testing an android application you may come across four different scenarios. I will list them down below concisely. A …
- 3,951
0
votes
Accepted
Would the attacker get a valid CSRF token if the session token is stolen?
Though vulnerabilities can be chained, we need to look at vulnerabilities from an independent perspective too. Fixes for one vulnerability might help in fixing another one, but that is not usually the …
- 3,951
1
vote
Is it safe to authenticate user by email confirmation link?
The current flow can be considered insecure for the following reasons.
An adversary having (even limited) access to somebody else's email can create, and use an account on behalf of them.
The authe …
- 3,951
1
vote
Admin Functionality visible to basic users
This is what I would do in such a case:
Verify if the redirect is a client side control.
Verify if I can escalate my privilege to that of a higher privileged user using the parameters of that user. …
- 3,951
3
votes
Accepted
Why does moving my mouse really quickly make recaptcha pass quicker?
I am assuming that you are talking about the No Captcha ReCaptcha here. This tick based ReCaptcha works based on javascript and a CSS styling element unlike the form input based conventional CAPTCHA. …
- 3,951