Skip to main content
53 votes
Accepted

Is the OWASP recommendation regarding localstorage still valid?

Personally I see no issue with using local storage as long as you are happy with the user not having to re-authenticate between sessions. The linked answer provides the following argument against this....
Hector's user avatar
  • 10.9k
25 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Yes, internal applications should be secured with due diligence and yes OWASP can be a good guide for securing your application. Also look over Microsoft's Security Development Lifecycle (SDL), It is ...
Kyle Fennell's user avatar
18 votes

Is the OWASP recommendation regarding localstorage still valid?

The reason local storage is considered unsafe is because any JavaScript that executes in the context of the page can access this. This opens you up to session hijacking via reflective XSS and stored ...
McMatty's user avatar
  • 3,260
13 votes
Accepted

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
gowenfawr's user avatar
  • 72.9k
10 votes
Accepted

Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 ...
Neil Smithline's user avatar
9 votes
Accepted

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are ...
Marc Ruef's user avatar
  • 1,110
9 votes
Accepted

Injecting <script>alert("1")</script> to OWASP Juice shop doesn't work

I went ahead and tried to determine what endpoint in the OWASP Juice Shop application you are injecting your payload into. Please correct me if I am wrong, but it appears that the payload is injected ...
EdOverflow's user avatar
  • 1,316
7 votes

Setting up OWASP ZAP Authentication

You can use the Zest functionality of ZAP to perform your authentication. In the icon bar on the top, on the far right you will find a tape icon that says "Record new Zest Script...". Hit it, choose a ...
stormpanda's user avatar
7 votes

Owasp Zap's active scan harming the database

Run the active scans against a non-production environment (replica of production). Have a process/script to easily restore a fresh copy of the live database if you break your non-production database ...
SecretSasquatch's user avatar
7 votes
Accepted

Some doubts about SQL Injection examples, how exactly works?

You've misread the injection, specifically this part: ""="" This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same ...
Conor Mancone's user avatar
6 votes
Accepted

Why does OWASP suggest using POST over PUT for file uploads?

TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface. @iain is correct in comment that the SO ...
grochmal's user avatar
  • 5,877
6 votes

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

Decrease client-side attacks. For example : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the ...
Sajjad Pourali's user avatar
6 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Others already mentioned some good points about evil employees, infiltration, defense in depth... but it's much more practical than that. I can attack your internal intranet application from a random ...
Luc's user avatar
  • 32.9k
5 votes

How can I edit HTTP request in OWASP ZAP and send the edited request?

Did you try right click, "resend"? Then you get a new window and in the "Request" tab you can change the parameters. Maybe it doesn't work in the "Sites" pane and you need to go to the "history" tab ...
kaidentity's user avatar
  • 2,654
5 votes

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

There's a core help for that, even has Firefox specific info (along with others): https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert#mozilla-firefox After you've exported ...
kingthorin's user avatar
5 votes

Owasp Zap's active scan harming the database

You shouldn't be running any tests against a live database, You should be using a segregated testing environment
user6858980's user avatar
5 votes
Accepted

External network pentest and Application pentest. The same?

In short, no, they are not the same. OWASP stands for open web application security project, which is why its guide is focused on the application side of things. You might find what you're looking ...
shivelin's user avatar
  • 458
5 votes
Accepted

Is OWASP ESAPI still the recommended way to secure JSP pages

The OWASP ESAPI is no longer considered a flagship or even an active project. Kevin Wall, the project owner for the Java implementation, himself back in 2014 conceded that the project is dying and ...
Mark Burnett's user avatar
  • 2,830
5 votes
Accepted

After a full web vulnerability scan, do we need to test each & every similar field for possible injections?

It all depends on how your application handles the fields. If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, ...
Simon Bennetts's user avatar
5 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Remember the giant Capital One breach in August 2019? The root cause was a server-side request forgery (SSRF) vulnerability in an internal Capital One app. So Yes, you need to worry about secure ...
Mike Ounsworth's user avatar
5 votes

Is non-executed content still considered XSS?

This is very common for automated scanning tools. They can only be so smart, and so false positives can always happen (as can false-negatives for that matter). As a result any flagged vulnerability ...
Conor Mancone's user avatar
4 votes
Accepted

How is Insufficient Attack Protection a Definite Threat/Risk to an Organization?

"Insufficient Attack Protection" is a horrible choice of words, but I don't have a suggestion on how to improve it. I've overseen applications which were missing really basic detection abilities and ...
mgjk's user avatar
  • 7,525
4 votes
Accepted

What wordlist does OWASP ZAP spider use?

For future reference: ZAP works as spider. Spiders crawl through data and find connection points in nodes. Webspiders follow links, sources, anchors in HTML, JS and CSS. Every time a connection is ...
Yorick de Wid's user avatar
4 votes
Accepted

Bypass char filtering - security shephard

My answer got longer than expected, so just to give you the answer: <body onpageshow="alert(1)"> probably works, and if it doesn't, <body onpaonpageonpagonpageonpageshowshoweshowshowgeshow="...
tim's user avatar
  • 29.6k
4 votes
Accepted

Is Blowfish validated against any standards?

Blowfish is an algorithm. An algorithm isn't validated against anything. What is validated is an implementation of an algorithm. Blowfish isn't defined by any text that calls itself a standard, as ...
Gilles 'SO- stop being evil''s user avatar
4 votes
Accepted

How to get user and verify password so that the usernames are kept private?

The easiest option I can see here is to avoid immediately returning from the first branch of the code. Instead, continue forward with a bogus hashed_password value and still do the verification. ...
VLAZ's user avatar
  • 370
4 votes
Accepted

What are the risks of publicly hosting OWASP Juice shop

If you're running nothing else on the same Azure instance, and nothing on that instance's filesystem contains anything sensitive, then there's not much of a risk factor. I reviewed a writeup of all ...
Polynomial's user avatar
  • 135k
4 votes
Accepted

Certificate Pinning for WebSockets

Securing secure websockets Secure Websockets start life as a standard HTTPS request and only connect if a valid HTTPS connection can be established with the server. As a result, websockets will ...
Conor Mancone's user avatar
4 votes

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

if an attacker is able to steal the JWT by performing a XSS attack and access the sessionStorage, the attacker can also send XHR-requests, so the Cookie is automatically send with it The solution ...
Greendrake's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible