Collaborate Disseminate
Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters?
In pseudo-code, creation of the URI looks like this:
URI = “/example/path?” +
“thing1=” + rawFormValueFro… Continue reading URI redirect with only query parameters
The definition of Insecure Direct Object Reference (IDOR) from OWASP is (emphasis mine)
Insecure Direct Object References occur when an application provides
direct access to objects based on user-supplied input. As a re… Continue reading Can an Insecure Direct Object Reference point to a plain file or page?
I’m trying to think how I would test an application for OWASP “Using Components with Known Vulnerabilities”.
If my understanding is correct, this deals a lot with out of date libraries/modules, but if one is pentesting an ap… Continue reading Test for OWASP Using Components with Known Vulnerabilities?
On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title:
I’m harvesting credit card numbers and passwords from your site.
Here’s how.
The be… Continue reading Malicious NPM Package – Does it fit into OWASP Top Ten 2017?
I researched over internet but I couldn’t find any tool/ways for checking Owasp top 10 vulnerability – Unprotected APIs. Please anyone can suggest how to proceed for testing Unprotected APIs vulnerability.
Continue reading How to test Owasp top 10 vulnerability – Unprotected APIs
I’ve been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I’m a little confused here, as I don’t understand how you could possibly check a web appl… Continue reading Checking if a web application uses known vulnerable components
I’ve been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I’m a little confused here, as I don’t understand how you could possibly check a web appl… Continue reading Checking if a web application uses known vulnerable components
I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that “Broken Account and Session Management” has changed place over the years:
In 2003 and 2004 it was A3.
In 2007 i… Continue reading How does OWASP rank the top 10 risks?
I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it.
The problem is that the cookies file is a file which contains session cookies. According to the OWASP top 10 Mobi… Continue reading How to encrypt cookies in Xamarin?
OWASP defines Cross-Site Request Forgery (CSRF) as
an attack that forces an end user to execute unwanted actions on a web
application in which they’re currently authenticated.
(emphasis mine)
An example of attack is… Continue reading Is a non-authenticated CSRF still a CSRF?