49
... SRC=my.server.public.ip DST=109.89.132.126 ...
... PROTO=TCP SPT=81 DPT=587 ... RST ...
This is a RST. It will be generated by your server if a remote system (in this case 109.89.132.126) tries to connect to a port on your system where no one is listening. Given that no one is listening on port 81 on your system it is sufficient that 109.89.132.126 has ...
18
A few possible explanations:
CSP: Check headers and meta tags. I agree that the onerror executing makes it unlikely, but I am not sure it would be impossible.
Browser XSS filter: Only an issue if you are doing reflected XSS. Turn them off, or use a browser without an XSS filter.
Malformed HTML: Are you sure the script tag is actually being interpreted as ...
9
It's most likely fine.
There are a few situations in which you want to communicate with localhost using HTTPS - such as running a local webserver for web development purposes or some other service that offers a web interface.
The way to do it "properly" is to generate a self-signed certificate, set up your web server to use that certificate, and ...
2
Description of the problem
You have a site xyz.mysite.com on Cloudflare (ip 1.1.1.2) which sits in front of your real server (ip 9.9.9.9). A different page, www.othersite.com is showing the contents of your site and you want to block it.
Possibilities
I see a few options on what could be happening:
www.othersite.com is resolving directly to your real ip 9.9....
2
I am the current lead of the OWASP Web Security Testing Guide.
What you are asking for are sinks, which are mostly found in DOM XSS attacks.
Version 4.2 of the guide will be released next week. We have mentioned the term sinks, and to help further with your question, I will add references where possible. In versions to come, the team will add more to the ...
2
As mobile applications do not have cookies - this is a wrong statement. The support of cookies is provided by the OS. You may want to look at CookieManager for Android or HTTPCookieStorage for iOS. Both Android and iOS apps do support cookies including httpOnly.
For JWT, the server should not care if the client is a browser or a native mobile app. If the ...
1
Just because an application accepts multiple Bearer strings or maybe will work without any Bearer string does not make the application vulnerable. The Bearer string by itself neither adds nor reduces security, the relevant information are all contained in the JWT itself.
Sure, it might be that this behavior is connected to a specific implementation which ...
1
This attack could help by grabbing the first item from a list and return it, based on how it is being handled. This scanner could be targeting a certain implementation that returns a list, and most of the examples with SQLi state that the first item is an admin user, sa for example.
some_var=' -> breaks the parser early on, no condition is gonna be ...
1
It's a way of an attack, called "Blind SQL Injection". Official Documentation from OWASP: https://owasp.org/www-community/attacks/Blind_SQL_Injection
Blind SQL (Structured Query Language) injection is a type of SQL
Injection attack that asks the database true or false questions and
determines the answer based on the applications response. This ...
1
Technically, you cannot protect a system against its administrator. So when a company hosts a site or an application in an external computer center, they trust that computer center to behave professionally.
For that reason, it in common not to externalize the most sensitive informations.
As usual when it comes to Information Security, everything ends as a ...
1
This is a perfectly reasonable thing to do.
If you don't require a user to verify their e-mail address before using your service (or perhaps you only require a username and password to sign up in the first place), then granting a user a session upon completing registration is a reasonable thing to do.
However, if you require the user to verify their e-mail ...
1
... prevent users from specifying internal URLs and only specifying servers accessible through the external internet?
I doubt that this is securely possible to proactively filter user input for this. An attacker can easily setup a DNS server which points to some internal IP address or domain, either by A/AAAA record or by CNAME. And given that this DNS ...
1
I think that means the CSP will allow scripts from the domain none. So if you were able to inject the following tag, the CSP would allow it to run:
<script src="http://none/evilscript.js">
and as long as the victim's machine can resolve none to a DNS name / IP address, you're in business!
The hard part of course will be getting either the ...
1
Answering my own question in case it's useful to others.
In order to distinguish between the 3 possible sources of URL 'leaks' I stopped monitoring the site from a Windows PC (Win10+Bitdefender+Chrome+various plugins) for 10 days from Oct 20-29th inclusive, and switched to monitoring only from the Linux server itself, again using Chrome.
At the end of that ...
1
ms-appx-web:// is an internal scheme of Edge for browser plugins, it's not a subject of CSP regulation. It's just an error in some Edge version or in the some plugin/extension.
Only top voted, non community-wiki answers of a minimum length are eligible
