61 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
Marcus Müller's user avatar
60 votes

What does the tilde (~) mean at the end of a file extension?

It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename. It's conventional to create "backups" of files before editing them by appending a ...
Luc's user avatar
  • 32.9k
50 votes

What does the tilde (~) mean at the end of a file extension?

~ is a common suffix added to filenames for backup or temporary copies of files. This may be a manual backup or one created by an editor or other tool. Although most file systems don't have a concept ...
IMSoP's user avatar
  • 3,860
42 votes

Is there a way to prevent someone from making his own client app for my webservice?

This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create ...
Justin Gerhardt's user avatar
34 votes

How to replace certain backup files on a website every 30 minutes?

Reverting the changes every 30 minutes is not a solution. You absolutely need to find out the root cause and stop this from happening by removing the vulnerability or the persistence. This may include ...
Esa Jokinen's user avatar
  • 18.9k
28 votes

Giving malicious crawlers and scripts a hard time

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
Dmitry Grigoryev's user avatar
28 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
Hector's user avatar
  • 11k
27 votes
Accepted

Is exposing exception information in web service a security risk?

The API should not expose any internal information, i.e stack traces or similar. As you really noticed they might leak information which might be used to attack the implementation. Moreover they are ...
Steffen Ullrich's user avatar
27 votes
Accepted

Why is CSRF protection only applicable to web services with browser clients?

It comes down to the fact that CSRF is an attack against browsers, so if your service is exclusively used by non-browsers there's no point in using anti-CSRF defences, which can be expensive so may be ...
Douglas Leeder's user avatar
25 votes

Is there a way to prevent someone from making his own client app for my webservice?

It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture ...
JOW's user avatar
  • 2,357
22 votes

Do I need to hash or encrypt API keys before storing them in a database?

Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
Anders's user avatar
  • 65.6k
21 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

There seems to be a bit of confusion here and other places, so I'm adding this answer in hopes that it will clarify the situation for other users. There are two types of API secrets that might be ...
Nick Sloan's user avatar
21 votes
Accepted

Is this bank website secure enough? No https in login page

doesn't use Https protocol The website you provided does support HTTPS, but not HSTS or HTTP to HTTPS redirect. That is why you could be directed to an unsecured HTTP site. SSL Labs analysis. ...
safesploit's user avatar
  • 1,867
19 votes
Accepted

Can the Host Header be used to hide the existence of a service?

The only way to determine the other name based virtual host on the same IP address is to perform forward lookups to all domains and see the A records with the same IP addess. Only after that it's ...
Esa Jokinen's user avatar
  • 18.9k
17 votes

Is there a way to prevent someone from making his own client app for my webservice?

From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic ...
micheal65536's user avatar
  • 1,766
16 votes

Giving malicious crawlers and scripts a hard time

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and ...
pineappleman's user avatar
  • 2,299
16 votes
Accepted

Swagger on production APIs

Publicly documenting your API gives attackers a head-start in identifying possible ways to abuse the API. If you expect to host a functional Swagger UI page, ensure that your API's Cross-Origin ...
PlasmaSauna's user avatar
12 votes

Giving malicious crawlers and scripts a hard time

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few ...
kubanczyk's user avatar
  • 1,192
12 votes

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If ...
Ruben_NL's user avatar
  • 119
11 votes

What are the security risks when using free Content delivery networks (CDNs)?

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and ...
Jedi's user avatar
  • 3,976
11 votes
Accepted

Damage of a leaked ETag

The ETag header is used for effective caching of server side resources by the client. The server send an ETag header in the HTTP response to some string and the client caches the response content and ...
Steffen Ullrich's user avatar
10 votes

Is this bank website secure enough? No https in login page

Presuming that is the actual login page: Yes, this is very insecure by modern standards, and even more so for anything involving actual monetary transactions. There is always the slim possibility ...
Conor Mancone's user avatar
10 votes

Is it worth storing email addresses as hashes?

Generally speaking, you shouldn't ask and hold user data (especially PII) that you don't need, this is even more true now under GDPR (if it applies in your scenario) but it's always been the case in ...
XCore's user avatar
  • 234
9 votes

How do I serve a webpage on a local PC without revealing my IP-address to end users?

In order to hide your IP address from users you need to make sure that they don't access your server directly, i.e. put some kind of reverse proxy in between. For public sites this can be done by ...
Steffen Ullrich's user avatar
8 votes
Accepted

What precautions should I take when creating users that will be used by applications and not by people?

Identification and tracking become important but surprisingly difficult. First, tag the accounts in the directory so you can identify them as non-user IDs. Each non-user account needs to be ...
John Deters's user avatar
  • 34.2k
8 votes

Is this bank website secure enough? No https in login page

Whomever designed the website appears to have a lack of security knowledge. As others have pointed out, they do support HTTPS, but at the very least you should be redirected from the HTTP to HTTPS ...
Steve Sether's user avatar
  • 21.6k
8 votes
Accepted

How can I prevent visitors from exposing their personal IP addresses to my server?

TLDR: Use Tor and .onion URLs. You have already named solutions: proxy server, VPN, or Tor. Browser extensions for anonymizing use effectively also a kind of proxy. Since your friends are not tech ...
mentallurg's user avatar
  • 12.3k
7 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

Putting in my own two cents because of one issue that has not yet been mentioned. In particular, I agree with what @NickSloan has said, but with one more caveat. There is one more important ...
Conor Mancone's user avatar
7 votes

Is exposing exception information in web service a security risk?

Usually, there are two kinds of exceptions: Expected exceptions, like invalid input values; or authentication failure; or asking for non-existing object. So you can (and should) be prepared to deal ...
deniss's user avatar
  • 193
7 votes
Accepted

Security mechanism differences between Google and Amazon APIs

I think the question here should more be answered from a marketing than a security perspective. In general, I would say that Google probably uses a relatively simple API key for usability/...
Bob Ortiz's user avatar
  • 6,645

Only top scored, non community-wiki answers of a minimum length are eligible