Hot answers tagged

51

Personally I see no issue with using local storage as long as you are happy with the user not having to re-authenticate between sessions. The linked answer provides the following argument against this. I would argue it is very weak - Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application ...


27

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


12

The reason local storage is considered unsafe is because any JavaScript that executes in the context of the page can access this. This opens you up to session hijacking via reflective XSS and stored XSS vulnerabilities, potentially information disclosure depending on the contents of your token. For example: If a user goes to a page with shared content ...


11

The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use ...


10

My experience is it depends on industry, regulations, and business relationships (not necessarily company size). Examples: <10 person company, building a web app that retrieves credit history, they were required by business partners to have a full webapp pentest <50 person company, building a web portal allowing customers to view point of sale ...


10

Specifically with regards to security questions you are asking users to share potentially sensitive facts about themselves that are likely obtainable by social engineering of people near them. That makes security questions at best inadvisable and at worst downright dangerous from a holisic security perspective. OWASP, while good overall for explaining the ...


10

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 every 3 years because this seems to balance the tempo of change in the AppSec market, all the work everyone does to map their tool/process/other thing to ...


9

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...


9

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an unapproved certificate authority. You need to import Zap's signing certificate into Firefox's Trusted Roots Certificate Store. If you Google "zap install ...


8

Short answer : NO. It is indeed shocking to know that most companies do not care about the security stature of their product or are ignorant about it. Usually, the QA teams in these companies perfrom the testing, and maybe the test cases would include some attack vectors for XSS, SQLi etc. But I'm pretty sure that they would not have a dedicated process ...


7

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


7

I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates ...


7

Run the active scans against a non-production environment (replica of production). Have a process/script to easily restore a fresh copy of the live database if you break your non-production database during the active scanning. It is best practice to avoid unnecessary risk on the production site. Also, you can be much more aggressive with your penetration ...


7

You've misread the injection, specifically this part: ""="" This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same thing as 1=1 (and they could have used 1=1 just as well here), and is therefore the equivalent of TRUE. So this clause: Name = "" OR ""="" Is the same as Name="...


6

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


6

The core mindset you want is: Build it as if it were real, not virtual. What would you want in place? Firewalls, access controls, logging etc For a lab running virus analysis etc., you would normally segregate that from the rest of your network, so do the same here. I don't know of any malware yet that is specifically designed to break out of a VM in ...


6

Decrease client-side attacks. For example : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : XSS with utf-7


6

I went ahead and tried to determine what endpoint in the OWASP Juice Shop application you are injecting your payload into. Please correct me if I am wrong, but it appears that the payload is injected via the search field. This appears to be DOM-based XSS and not reflected XSS. This is important to note since the payload is passed on to the innerHTML method: ...


5

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the name ...


5

Setting up a vulnerable web app in a virtual machine is relatively safe. The risk is an attacker gaining access to that VM over the network, so as long as you restrict network access to the virtual machine there won't be a problem. As I understand it by default VMWare (and other VM software) will be configured in this way. Realistically if you have your ...


5

Short Answer: No. (at least not in the versions I have worked with) Longer Answer: ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false ...


5

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...


5

TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface. @iain is correct in comment that the SO question PUT vs POST in REST is relevant here. From the RESTfulness point of view PUT is fine for updating or even overwriting a file. Yet, if you argue from ...


5

It all depends on how your application handles the fields. If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, applications usually use fields differently. There are various ways to speed up ZAP scans - see this blog post: https://blog.mozilla.org/security/2013/07/10/how-to-...


4

Summarizing atdre's link: OWASP ESAPI conveniently provides a mapping from a set of indirect references to the direct references, so convenient that you can even use a different mapping upon each request to your service. Alternatives include container-managed security, Apache Shiro, and Spring Security, all of which are discussed in a StackOverflow question....


4

A common practice after a form post is to redirect a user to success page: POST /my-form HTTP/1.1 Host: www.myhost.com HTTP/1.1 302 Moved Temporarily Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E In this example the user is redirected to the form-success.html page, with the message of: <b>Success!</b> We ...


4

From an auditor's point of view, I do not expect you to go through every single line of code of used libraries IF the library is commonly used and vetted. If you are using "random code you found on the internet" for a transaction system then I expect you to have had a review on the code. Now for the more used and vetted libraries I would simply review the ...


4

By storing a staled hash of the password and then using this same hash as an authentication token, an application is more vulnerable to attack because this application is now storing authentication credentials in plain-text. An attacker can use SQL Injection to read this hash and then authenticate without having to crack the hash to obtain the plaintext ...


4

There are loads. Mutillidae, Damn Vulnerable Web App, WebGoat, BWaPP etc. Also, check out vulnhub, hack.me and others like them.


4

No, as you've noted, it was abandoned in 2010, and is completely unsupported and thoroughly outdated at this point in time. You should definitely look somewhere else, and where exactly depends on your specific needs.


Only top voted, non community-wiki answers of a minimum length are eligible