Hot answers tagged

119

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. Very few people will click on a link to https://evilphishingsite.example.com, but they might click on https://catphotos.example.com?redirect=https://...


118

Financial institutions in the United States are obliged by the Gramm-Leach-Bliley Act to ensure the security and confidentiality of personal information. What you describe is a flagrant violation of the FTC's Safeguards Rule. I would immediately file a complaint with the FTC.


92

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


90

If you are concerned about the privacy of your password and thus your account (which should be the case), you should try to educate the customer service. The developer FAQ from the public shaming project for this kind of recklessness lists a few good points and is worth a read. Also, you should point out that you feel insecure and lose trust in the company ...


86

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, until I looked further and found that I was also able to insert Javascript code (XSS) into those notes. So in other words, I could exploit XSS on every visitor's ...


77

To quote their FAQ: Aren’t you worried hackers will use your site to find targets? Yes, but less worried than having this information remain secret and relying on Security Through Obscurity. To be more verbose: There are two possible outcomes from submitting a site there: They fix it - This is more likely to happen when they get publicly shamed. ...


68

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on Firefox Firefox loaded with certs, a test site that requires a TLS client cert, Wireshark. I restarted Firefox to get a clean session. Then I entered the URL ...


60

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you specifically. The payload itself just appears to just be testing to see if the server is vulnerable to command injection. It does not appear to have any additional ...


58

Your question is: Are security flaws acceptable if no much harm can derive from them? The answer is yes, if decided by business while understanding the consequences. What you are doing is called a risk assessment. For each risk you must highlight the consequences for your company when it is instantiated. Based on that assessment you (you = someone who has ...


50

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


36

So, hashing the user password before entering it into the query is a coincidental security feature to prevent SQL injection, but you can't necessarily do that with all user input. If I'm looking up a Customer by their Name and I have a query like Select * from Customer Where Name like '%userInput%' If I set userInput as a hashed version of what was typed ...


33

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the headers. The request URL is just one part of HTTP that gets encrypted together with all the other components. If any party was able to read the URL, they would ...


31

The problem that I see with such a simple password reset scheme is that it suggests further vulnerabilities in the platform. A flawed concept of security is rarely so isolated as to only happen once, since such flaws are usually related to a developer's practices regarding security. At minimum, I'd suspect that their internal login procedures might also be ...


31

Security / Privacy disadvantage There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not having a default flow. As mentioned @Mario Trucco this can also be done via the registration process. Security is at risk: Because it becomes easier for an ...


31

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users. From https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web ...


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


22

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to see.


22

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and other scripting languages' equivalents). I note that the executable code appears immediately after the first version parameter after Mozilla/. This means the ...


16

If I see this scenario right, they can change E-Mail address and password of any account, then start a repair-form and continue the repair-process via mail. The support team will probably assume that the E-Mail address is legit and sensitive information can be exchanged with the recipient - and if it is a know customer, you might even start working on an ...


15

Passwords are not a requirement for authentication in some cases. The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity Provider that will authenticate the user. That ID provider might use a password but is not required to; many alternate login flows can happen passively or use ...


13

The question seems to make the assumption that plaintext offenders is the only site which maintains such a list, rather than just being the one with the highest white-hat public profile. There are, however, plenty of other, less salubrious sites, which maintain such lists; any domain listed on Plaintext Offenders is likely to have been on these other sites ...


12

One thing that's important to understand is that there a practical difference between "password exposure" and "more risk." You can say with certainty that submitting a site to plaintext offenders results in additional password exposure. This fact is not in question. Whether it results in additional risk, however, is more nuanced. If the site does ...


12

The problem is that you sometimes refer to https resources by https://jlucina.com; for example one image is located at: https://jlucina.com/sites/default/files/pin.png Now your web site is setup that https://jlucina.com 301 redirects to http://www.jlucina.com, so despite the https in the source the resource is sent unencrypted over the network, so you get ...


12

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link without switch, and use another LAN connection on benchmarking server to ssh to one server to run the test. Another way is to provision servers in Public Cloud ...


9

The crux is that using your redirect leverages the good name of your business to get someone to click on the malicious link.


8

I consider things like "script injections awareness" and "firewall" and also "..." as far from simple. And don't forget the bugs, backdoors, critical information leaks etc you regularly find in critical software or hardware like glibc, openssl, firewalls, VPN routers ... And of course there is way more than this if you have a complex infrastructure and ...


7

Basically yes, if you hash input (represented in Hex or Base64 format) before passing it to SQL, it can no longer be an effective SQLi attack vector. The same goes if you parseInt the input. Those simply do not support the characters needed for a useful SQLi. (namely to break out of the quoted string) This technique has only limited utility in practice. i.e....


7

Use the following setting in your apache config or in a .htaccess file: php_flag engine off See also Disable PHP in directory (including all sub-directories) with .htaccess.


7

HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly stored on the clients side as a cookie and on the server side in a database. If the attacker can make use of this session ID he can do actions as the authorized ...


7

In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf. Your linked video shows a typical scenario: Many community websites give you the ability to provide a link to a resource, e.g. the URL to a profile picture you want to upload (StackExchange does that, too). The web server ...


Only top voted, non community-wiki answers of a minimum length are eligible