120
votes
Accepted
What is the purpose of (ab)using the redirect page of my website for dubious URLs?
Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. ...
- 27.4k
75
votes
How are short passwords not safe if you limit the number of attempts?
The main reason passwords need to be long and random (i.e. high entropy) is to protect against offline brute force attacks.
Passwords are usually not stored in plain text. Instead, they are hashed. ...
- 65.8k
70
votes
Accepted
Does a client certificate identify the owner to unrelated websites?
Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this!
(Skip to the bottom for a summary)
Investigation
Testing on ...
- 59.3k
59
votes
Accepted
What exploit are these user agents trying to use?
It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
- 3,322
44
votes
Accepted
ELI5: If SSL encrypts traffic, why does it expire?
Certificate expiration is a security feature.
Over time, domains can change ownership, private keys can be compromised and certificates can be fraudulently issued. These events mean that we no longer ...
- 34.7k
37
votes
Accepted
Why do some sites ask for username/email and password on two separate screens?
Security / Privacy disadvantage
There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not ...
- 848
36
votes
Accepted
Could hashing prevent SQL injection?
So, hashing the user password before entering it into the query is a coincidental security feature to prevent SQL injection, but you can't necessarily do that with all user input. If I'm looking up a ...
- 1,220
36
votes
Accepted
How are short passwords not safe if you limit the number of attempts?
It's not as simple...
About online brute force
If an account becomes completely locked after 3 attempts, it will be easy to make a DOS (Denial Of Service) attack by locking all accounts!
Servers have ...
33
votes
What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol?
Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption.
HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the ...
- 45.1k
32
votes
What is the purpose of (ab)using the redirect page of my website for dubious URLs?
If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users.
From https://www.owasp.org/index.php/...
- 1,962
22
votes
What exploit are these user agents trying to use?
It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
- 2,736
22
votes
What exploit are these user agents trying to use?
The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
- 1,738
21
votes
Accepted
What is this potential identity leak that NoScript warns about?
So after some digging into NoScript's settings, I found some settings for something called "Cross-tab identity leak protection". Googling this led to a tor project issue Targeted ...
- 11.6k
18
votes
Why do some sites ask for username/email and password on two separate screens?
Passwords are not a requirement for authentication in some cases.
The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity ...
- 476
15
votes
ELI5: If SSL encrypts traffic, why does it expire?
Your confusion is likely due to a misunderstanding (or at least, incomplete understanding) of what certificates are for. Yes TLS encrypts traffic between you and the server, but you can do that with ...
- 470
12
votes
ELI5: If SSL encrypts traffic, why does it expire?
Basically it's so that certificate revocation lists don't grow forever.
When a certificate is compromised it is put on a revocation list so that the compromised cetificate can't be used, in ...
- 1,376
11
votes
Accepted
What is the term for when a hyperlink maliciously opens different URL from URL displayed when hovered over?
Such attacks have been called Click Interception in a fairly recent Usenix paper. They could also be considered a form of Action Spoofing.
Disabling JavaScript for untrusted sites is definitely the ...
- 22.9k
9
votes
What is the purpose of (ab)using the redirect page of my website for dubious URLs?
The crux is that using your redirect leverages the good name of your business to get someone to click on the malicious link.
- 3,012
9
votes
How is Instagram detecting me and blocking me each and every time I try to create a new account through different medium?
Instagram app sends the device id to its servers. So your devices are already known to them. Your best way would be:
A new device
A new email provider
Never connect to your wi-fi on this new device ...
- 219
9
votes
How are short passwords not safe if you limit the number of attempts?
To prevent "password spraying" where someone tries a common password against many accounts.
- 34.7k
8
votes
Is there any reason to log out of websites?
HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly ...
- 208k
8
votes
Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?
The JSON issue that led google to prepend while was a same-origin breakdown in early versions of firefox (1.5 and 2b specifically) where the JSON file could be loaded as a normal script tag from off-...
- 2,703
8
votes
Accepted
Is some kind of CSRF possible using img/script tag to read sensitive information
With just an image tag - no. For the attacker to be able to gather data from the API endpoint and return it to himself, he would have to have javascript on the page under his control. With ...
- 31.7k
8
votes
Accepted
Can Javascript overwrite a HTTPOnly cookie?
While you might not be able to rewrite the cookie you might be able to shadow it. The specific behavior depends on the browser though. With Firefox I can set a site-global HttpOnly cookie with path=/ ...
- 208k
8
votes
How to make sure that no one is watching you through webcam?
If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only ...
- 31.7k
7
votes
Accepted
SSRF Attack Exploitation Scenario
In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf.
Your linked video shows a typical scenario: Many community ...
- 45.1k
7
votes
Ways to bypass browsers CORS Policy
You can use the following content types without CORS access:
application/x-www-form-urlencoded
multipart/form-data
text/plain
You can try a couple of things:
Try sending valid JSON with another ...
- 34.4k
7
votes
Could hashing prevent SQL injection?
Basically yes, if you hash input (represented in Hex or Base64 format) before passing it to SQL, it can no longer be an effective SQLi attack vector. The same goes if you parseInt the input. Those ...
- 14k
7
votes
Accepted
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
shell.php.jpg should be treated as a .jpg file
You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
- 1,749
7
votes
Accepted
Does HTTP/2 prevent security vulnerabilites like CRLF injection?
TLS related security features in HTTP/2
The concrete security improvements mentioned in the FAQ are related to TLS encryption: HTTP/2 MUST use at least TLS 1.2 and it support SNI. Also, HTTP/2 ...
- 19.4k
Only top scored, non community-wiki answers of a minimum length are eligible