How to Stop Old, Backup and Unreferenced Files from Leaking Sensitive Information

The very real threat of information disclosure by means of inadvertent exposure of sensitive files has been a constant source of woe for corporations and individuals alike. Despite having the potential for serious repercussions including legal ones, many webmasters, administrators and developers have struggled to contain this common issue for years. This article explores various […]

Read More →

How to Verify a Cross-site Scripting Vulnerability

Analyzing web application vulnerabilities discovered by an automated scanner such as Acunetix often requires us to investigate further. This is in order to: Verify the vulnerability exists in the context of the application. Adjust the vulnerability payload reported by the scanner to something more invasive (i.e. keylogger) in order to make the severity of the […]

Read More →

Why Scoping Cookies to Parent Domains is a Bad Idea

When dealing with Web Application vulnerability assessments, it is very common to come across scenarios where for various reasons (business or otherwise) users decide to focus entirely on Medium or High severity vulnerabilities such as SQL Injection and XML External Entity Injection. As a result, developers and security professionals tend to ignore what are normally […]

Read More →

What is Web Cache Poisoning?

How does Caching work? All forms of Caching in computer science, whether it be CPU cache, HTTP Web Server cache, Database cache and so on, aims to speed up response times for whatever is requested. Doing so helps reduce load as much as possible on the component that is being actively cached. Because of this […]

Read More →

How to Prevent DOM-based Cross-site Scripting

DOM-based Cross-site Scripting (from now on called DOM XSS) is a very particular variant of the Cross-site Scripting family and in web application development is generally considered the amalgamation of the following: The Document Object Model (DOM) – Acting as a standard way to represent HTML objects (i.e. <div></div>) in a hierarchical manner. Cross-site Scripting […]

Read More →

What is Password Reset Poisoning?

Most of web application security vulnerabilities, leverage user input in ways that were not initially intended by their developer(s). Password Reset Poisoning is one such vulnerability, that leverages commonly unthought of headers, such as the Host header seen in an HTTP request: GET https://example.com/reset.php?email=foo@bar.com HTTP/1.1 Host: evilhost.com Notice the difference where we specify the host […]

Read More →

How to Recover from a Hacked Website Event

Any fellow webmaster you may ask who is beyond the novice stage will agree that one of his top priorities will always be keeping his websites secure. However, the number of exploits and tools available to hackers are so vast, and software technologies evolving so rapidly, that it is very possible, maybe likely, that you […]

Read More →

A Security-focused Introduction to HTTP, Part 2

This is the second part of a two part series on HTTP basics. In this second part, we cover several attributes of the HTTP protocol such as encoding, HTTP headers and authentication in more detail. Query strings The query string is defined using the question mark (?) character after the URL within an HTTP request. […]

Read More →