New answers tagged web-application
0
votes
Storing Anti-CSRF token in cookie with samesite=strict
You can not stick only with samesite, it has its own limitations and overall we can not rely on this cookie flag for complete mitigation for CSRF Vulnerability. You have to use anti-CSRF Tokens.
You ...
1
vote
Storing Anti-CSRF token in cookie with samesite=strict
This approach is overcomplicted and probably unnecessary (in the no-session case), and possibly insecure (in the session case) anyhow because it ultimately rests on SameSite, which is a defense-in-...
- 38.9k
1
vote
Accepted
Is it possible to get xss in json body request?
So there any possibility to get XSS in json body?
XSS is not about how the code fragment is transported but where it is included. Thus it does not matter if it is transport with JSON, XML, plain text,...
- 181k
0
votes
Session id remain same after and before logging in asp.net application
Yes, this is a bug. Specifically, it is a type of session fixation vulnerability. The attack scenario looks like this:
Person A uses a device (possibly a friend's phone, possibly a machine at an ...
- 38.9k
0
votes
How to store user credentials in browser securely?
If your storing any data client-side, it is not secure and can be easily accessed by the user. One way of resolving this issue is by encrypting and decrypting your user's data. When encrypting the ...
0
votes
WSS protocol vs HTTPS protocol as an iframe embedded source in a web page
WSS is just WebSockets (WS) over TLS, similar how HTTPS is just HTTP over TLS. Using WS or WSS by itself does neither introduce new risks to the client side, nor does it add additional protection.
Of ...
- 181k
0
votes
SQL Injection and Hidden parameter modification
You send data to login.pl.
Try downloading login.pl and reading the content code.
If the code is really vulnerable, the Perl file will have a query line to the vulnerable database.
Put the code ...
1
vote
Altering requests after authenticating
Some common ideas are following:
Don't send user ID to the client. Instead, generate some token (session ID), e.g. UUID like aecf4b7b-5589-4fb0-bce3-b17194d5d432. In the database save this token and ...
- 8,410
1
vote
Accepted
Altering requests after authenticating
Yes, good web app design never trusts the input from the client; always assume that it could be malicious.
After authentication and that means that he has access to the API,is it possible to alter ...
- 57.4k
0
votes
What's the best way to encrypt and store text in a MongoDB database?
Announced 7 June 2022:
Queryable Encryption is a feature that enables you to encrypt data in
your application before you send it over the network to MongoDB while
still maintaining the ability to ...
0
votes
Is there any actual security benefit to restricting foreign IP addresses?
The official Apple website blocks IP addresses from Ghana (interestingly enough not from Nigeria though), and they openly state this is because of fraud concerns. Straight away, the fact a big company ...
- 159
0
votes
Windows IP Helper service listening on port 1000
Looking at the documentation for the Windows IP Helper, I found the function CreatePersistentTcpPortReservation:
The CreatePersistentTcpPortReservation function is used to add a persistent ...
- 46
0
votes
Windows IP Helper service listening on port 1000
Nmap does not have service probes for cadlock, so the service is detected based on the port number, alone. The port 1000/tcp is IANA assigned for cadlock2, but it could be used by anything; including ...
- 15.9k
1
vote
Path traversal in REST style URLs?
There is no such thing as "REST style URLs". All URLs are just URLs. If you wanted to ask if REST services are vulnerable to path traversal attacks, here is the answer.
It depends on the ...
- 8,410
Top 50 recent answers are included