Skip to main content
119 votes
Accepted

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. ...
Matthew's user avatar
  • 27.3k
91 votes

How to deal with WPE users

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are ...
Tobi Nary's user avatar
  • 14.4k
86 votes

Are security flaws acceptable if not much harm can derive from them?

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, ...
O'Niel's user avatar
  • 2,916
75 votes

How are short passwords not safe if you limit the number of attempts?

The main reason passwords need to be long and random (i.e. high entropy) is to protect against offline brute force attacks. Passwords are usually not stored in plain text. Instead, they are hashed. ...
Anders's user avatar
  • 65.6k
70 votes
Accepted

Does a client certificate identify the owner to unrelated websites?

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on ...
Mike Ounsworth's user avatar
61 votes
Accepted

Are security flaws acceptable if not much harm can derive from them?

Your question is: Are security flaws acceptable if no much harm can derive from them? The answer is yes, if decided by business while understanding the consequences. What you are doing is called a ...
WoJ's user avatar
  • 9,048
59 votes
Accepted

What exploit are these user agents trying to use?

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
Dan Landberg's user avatar
  • 3,322
50 votes

How to deal with WPE users

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model,...
Mike Ounsworth's user avatar
36 votes
Accepted

Could hashing prevent SQL injection?

So, hashing the user password before entering it into the query is a coincidental security feature to prevent SQL injection, but you can't necessarily do that with all user input. If I'm looking up a ...
Ryan Kelso's user avatar
  • 1,220
36 votes
Accepted

Why do some sites ask for username/email and password on two separate screens?

Security / Privacy disadvantage There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not ...
Ludisposed's user avatar
36 votes
Accepted

How are short passwords not safe if you limit the number of attempts?

It's not as simple... About online brute force If an account becomes completely locked after 3 attempts, it will be easy to make a DOS (Denial Of Service) attack by locking all accounts! Servers have ...
F. Hauri  - Give Up GitHub's user avatar
33 votes

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol?

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the ...
Arminius's user avatar
  • 44.9k
32 votes

Are security flaws acceptable if not much harm can derive from them?

The problem that I see with such a simple password reset scheme is that it suggests further vulnerabilities in the platform. A flawed concept of security is rarely so isolated as to only happen once, ...
phyrfox's user avatar
  • 5,724
31 votes

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users. From https://www.owasp.org/index.php/...
JesseM's user avatar
  • 1,952
25 votes

How to deal with WPE users

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you ...
UTF-8's user avatar
  • 2,340
22 votes

What exploit are these user agents trying to use?

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
DarkMatter's user avatar
  • 2,691
22 votes

What exploit are these user agents trying to use?

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
Dai's user avatar
  • 1,728
21 votes
Accepted

What is this potential identity leak that NoScript warns about?

So after some digging into NoScript's settings, I found some settings for something called "Cross-tab identity leak protection". Googling this led to a tor project issue Targeted ...
nobody's user avatar
  • 11.6k
18 votes

Why do some sites ask for username/email and password on two separate screens?

Passwords are not a requirement for authentication in some cases. The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity ...
Joe's user avatar
  • 466
16 votes

Are security flaws acceptable if not much harm can derive from them?

If I see this scenario right, they can change E-Mail address and password of any account, then start a repair-form and continue the repair-process via mail. The support team will probably assume that ...
Falco's user avatar
  • 1,502
12 votes
Accepted

How to perform a proper DDoS test in a safe and controlled way?

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link ...
Aria's user avatar
  • 2,701
9 votes

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

The crux is that using your redirect leverages the good name of your business to get someone to click on the malicious link.
Joe M's user avatar
  • 3,012
9 votes

How are short passwords not safe if you limit the number of attempts?

To prevent "password spraying" where someone tries a common password against many accounts.
paj28's user avatar
  • 33.5k
8 votes

Is there any reason to log out of websites?

HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly ...
Steffen Ullrich's user avatar
8 votes

Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?

The JSON issue that led google to prepend while was a same-origin breakdown in early versions of firefox (1.5 and 2b specifically) where the JSON file could be loaded as a normal script tag from off-...
dandavis's user avatar
  • 2,693
8 votes
Accepted

Is some kind of CSRF possible using img/script tag to read sensitive information

With just an image tag - no. For the attacker to be able to gather data from the API endpoint and return it to himself, he would have to have javascript on the page under his control. With ...
Conor Mancone's user avatar
8 votes
Accepted

Can Javascript overwrite a HTTPOnly cookie?

While you might not be able to rewrite the cookie you might be able to shadow it. The specific behavior depends on the browser though. With Firefox I can set a site-global HttpOnly cookie with path=/ ...
Steffen Ullrich's user avatar
8 votes

How to make sure that no one is watching you through webcam?

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only ...
Conor Mancone's user avatar
7 votes

Could hashing prevent SQL injection?

Basically yes, if you hash input (represented in Hex or Base64 format) before passing it to SQL, it can no longer be an effective SQLi attack vector. The same goes if you parseInt the input. Those ...
700 Software's user avatar
7 votes
Accepted

SSRF Attack Exploitation Scenario

In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf. Your linked video shows a typical scenario: Many community ...
Arminius's user avatar
  • 44.9k

Only top scored, non community-wiki answers of a minimum length are eligible