Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options questions only user 5169

An application that is accessed over a network such as the Internet or an intranet using a browser.

0
votes
1answer
I have been thinking about creating a Wordpress vulnerability scanner that would look for plugins being used by a Wordpress site and then search osvdb for known vulnerabilities. I'm curious if there …
asked Oct 2 '13 by Abe Miessler
4
votes
1answer
Is it a bad idea from a security perspective to host both a publicly accessible website and a website that is only intended to be used internally on the same server? Obviously the web server would be …
asked Sep 27 '13 by Abe Miessler
5
votes
2answers
Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might subm …
asked Oct 30 '13 by Abe Miessler
4
votes
1answer
I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your web …
asked Sep 2 '13 by Abe Miessler
12
votes
3answers
I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks. Will doi …
asked Apr 29 '13 by Abe Miessler
7
votes
2answers
My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one belo …
asked Jun 30 '14 by Abe Miessler
5
votes
3answers
I have always looked at reflected XSS as an attack that would take place through a URL. So, for example, you would have a URL like below: http://someSite.com?message=welcome!<script>alert(1);</scrip …
asked Oct 16 '14 by Abe Miessler
3
votes
2answers
I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes: No access to File System IO No e …
asked Nov 20 '13 by Abe Miessler
10
votes
2answers
I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a …
asked Sep 18 '13 by Abe Miessler
1
vote
3answers
So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then cre …
asked Aug 11 '14 by Abe Miessler
7
votes
3answers
I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration. I am working with a front end developer who feels pretty strongly that we should …
asked Sep 12 '13 by Abe Miessler
0
votes
2answers
When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to informati …
asked May 31 '13 by Abe Miessler
16
votes
3answers
If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I under …
asked Jun 4 '14 by Abe Miessler
66
votes
10answers
Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super com …
asked Feb 7 '14 by Abe Miessler
2
votes
1answer
I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page. Is there any w …
asked Dec 4 '12 by Abe Miessler

15 30 50 per page