Hot answers tagged

86

While Kyle Fennell's answer is very good, I would like to offer a reason as to why it is recommended for internal applications to be designed securely. A large number of attacks involve internal actors There are many different versions of this factoid. "50% of all successful attacks begin internally", "Two thirds of all data breaches involve internal ...


53

Personally I see no issue with using local storage as long as you are happy with the user not having to re-authenticate between sessions. The linked answer provides the following argument against this. I would argue it is very weak - Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application ...


27

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


25

Yes, internal applications should be secured with due diligence and yes OWASP can be a good guide for securing your application. Also look over Microsoft's Security Development Lifecycle (SDL), It is a security assurance process that is focused on software development. Why? Defense in depth. An attacker could breach the network defenses. Put more layers of ...


12

The reason local storage is considered unsafe is because any JavaScript that executes in the context of the page can access this. This opens you up to session hijacking via reflective XSS and stored XSS vulnerabilities, potentially information disclosure depending on the contents of your token. For example: If a user goes to a page with shared content ...


11

The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use ...


10

My experience is it depends on industry, regulations, and business relationships (not necessarily company size). Examples: <10 person company, building a web app that retrieves credit history, they were required by business partners to have a full webapp pentest <50 person company, building a web portal allowing customers to view point of sale ...


10

Specifically with regards to security questions you are asking users to share potentially sensitive facts about themselves that are likely obtainable by social engineering of people near them. That makes security questions at best inadvisable and at worst downright dangerous from a holisic security perspective. OWASP, while good overall for explaining the ...


10

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 every 3 years because this seems to balance the tempo of change in the AppSec market, all the work everyone does to map their tool/process/other thing to ...


10

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an unapproved certificate authority. You need to import Zap's signing certificate into Firefox's Trusted Roots Certificate Store. If you Google "zap install ...


9

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...


8

Short answer : NO. It is indeed shocking to know that most companies do not care about the security stature of their product or are ignorant about it. Usually, the QA teams in these companies perfrom the testing, and maybe the test cases would include some attack vectors for XSS, SQLi etc. But I'm pretty sure that they would not have a dedicated process ...


7

I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates ...


7

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


7

Run the active scans against a non-production environment (replica of production). Have a process/script to easily restore a fresh copy of the live database if you break your non-production database during the active scanning. It is best practice to avoid unnecessary risk on the production site. Also, you can be much more aggressive with your penetration ...


7

You've misread the injection, specifically this part: ""="" This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same thing as 1=1 (and they could have used 1=1 just as well here), and is therefore the equivalent of TRUE. So this clause: Name = "" OR ""="" Is the same as Name="...


6

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


6

Decrease client-side attacks. For example : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : XSS with utf-7


6

TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface. @iain is correct in comment that the SO question PUT vs POST in REST is relevant here. From the RESTfulness point of view PUT is fine for updating or even overwriting a file. Yet, if you argue from ...


6

I went ahead and tried to determine what endpoint in the OWASP Juice Shop application you are injecting your payload into. Please correct me if I am wrong, but it appears that the payload is injected via the search field. This appears to be DOM-based XSS and not reflected XSS. This is important to note since the payload is passed on to the innerHTML method: ...


6

Others already mentioned some good points about evil employees, infiltration, defense in depth... but it's much more practical than that. I can attack your internal intranet application from a random web page. People click links all day. Sometimes because a colleague saw something they want to share, sometimes from search results (or ads), sometimes a cute ...


5

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the name ...


5

You can use the Zest functionality of ZAP to perform your authentication. In the icon bar on the top, on the far right you will find a tape icon that says "Record new Zest Script...". Hit it, choose a name and choose "Authentication" for the "Type" dropdown. Now open the a browser via ZAP and manually perform a login to you site. Stop the recording by ...


5

Short Answer: No. (at least not in the versions I have worked with) Longer Answer: ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false ...


5

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...


5

There's a core help for that, even has Firefox specific info (along with others): https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert#mozilla-firefox After you've exported and saved ZAP's CA cert: Firefox is using it's own certificate store. Thats why you have to import it twice, when you're using both browser on windows. ...


5

In short, no, they are not the same. OWASP stands for open web application security project, which is why its guide is focused on the application side of things. You might find what you're looking for here: http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines However, conducting pentests is best left for professionals - they will be more ...


5

It all depends on how your application handles the fields. If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, applications usually use fields differently. There are various ways to speed up ZAP scans - see this blog post: https://blog.mozilla.org/security/2013/07/10/how-to-...


5

This is very common for automated scanning tools. They can only be so smart, and so false positives can always happen (as can false-negatives for that matter). As a result any flagged vulnerability should be manually verified. This is why, for instance, bug bounty programs always have notices like "Results from automated scanners will not be considered" - ...


4

A common practice after a form post is to redirect a user to success page: POST /my-form HTTP/1.1 Host: www.myhost.com HTTP/1.1 302 Moved Temporarily Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E In this example the user is redirected to the form-success.html page, with the message of: <b>Success!</b> We ...


Only top voted, non community-wiki answers of a minimum length are eligible