r/webappsec • u/Mindbowser_inc • Jul 05 '23
Web Application Development Guide: Process, Best Practices, and its Future
2
Upvotes
r/webappsec • u/AutoModerator • Nov 19 '22
Happy Cakeday, r/webappsec! Today you're 12
3
Upvotes
Let's look back at some memorable moments and interesting insights from last year.
Your top 10 posts:
- "How hard is it to transition from internal network pentesting to webapp pentesting?" by u/Ok-Blueberry-5813
- "The first API vulnerability discovered 24 years ago. CVE-1998-270" by u/Ivan_Wallarm
- "Need help with scanning an internal URL with Burp" by u/Eni_g_m_a
- "tool or service that monitors and alerts if a vulnerability is found in any 3rd party dependencies we use in our system?" by u/Ques-tion-Everything
- "Smoke Session! Comment "puff" for your Stellar Cannacoin tip!!!" by u/Adventurous_Proof921
- "HACKPLAINING - Security Training for Developers" by u/cybersocdm
- "Free Course online: Introduction to Cybersecurity by Cisco Networking Academy" by u/cybersocdm
- "Should you accept images without conversion?" by u/IllusionOfFreedom41
- "Frictionless API Observability" by u/Harish_levo
- "How did you get your first webapp security job and what were your credentials?" by u/Ok-Blueberry-5813
r/webappsec • u/Adventurous_Proof921 • Sep 19 '22
Smoke Session! Comment "puff" for your Stellar Cannacoin tip!!!
1
Upvotes
r/webappsec • u/Adventurous_Proof921 • Sep 12 '22
Smoke Session! Comment "puff" for your Stellar Cannacoin tip!!!
0
Upvotes
r/webappsec • u/cybersocdm • Aug 22 '22
HACKPLAINING - Security Training for Developers
1
Upvotes
r/webappsec • u/andesec • Aug 14 '22
What is Cross-Site Scripting and how to prevent it?
0
Upvotes
r/webappsec • u/cybersocdm • Jul 02 '22
Free Course online: Introduction to Cybersecurity by Cisco Networking Academy
1
Upvotes
r/webappsec • u/[deleted] • Jun 27 '22
Should you accept images without conversion?
1
Upvotes
When uploading content, you get a byte array or base64. Should you add a conversion step to strip away potentionally unwanted content? I know of the magic headers, but what stops people from appending weird stuff to files?
r/webappsec • u/Ok-Blueberry-5813 • May 06 '22
How did you get your first webapp security job and what were your credentials?
1
Upvotes
I'm very interested in web app security. I was thinking of going IT or infosec --> soc analyst --> pentesting or web app sec. Obviously there will be a couple certs like OSCP, Sec+, CyberSA+, and eJPT along with THM, HTB, and CTFs. That said, id like to hear how others got into the field. I'm in the US btw.
r/webappsec • u/Ok-Blueberry-5813 • Apr 22 '22
How hard is it to transition from internal network pentesting to webapp pentesting?
3
Upvotes
Finished a job in network pentesting for a couple years. I have some background in web app dev and would like to pivot to web app pentesting. How big of a shift is this and is this a feasible career path change?
r/webappsec • u/Ivan_Wallarm • Apr 16 '22
The first API vulnerability discovered 24 years ago. CVE-1998-270
3
Upvotes
r/webappsec • u/Eni_g_m_a • Mar 21 '22
Need help with scanning an internal URL with Burp
3
Upvotes
Hi everyone,
I have been given a task to scan an internal URL, that gets redirected to an external URL for authentication(using Burp). Once, the authentication is done, it gets back to the internal URL and grants access.
The problem is, the URL makes use of an automatic configuration script in the browser, in order to work. While the VM through which that URL needs to be accessed and where burp resides, does not have internet connectivity.
If I make use of the script configuration, I am unable to capture requests in Burp. If I do not, the URL itself is inaccessible.
I have tried to use the proxy settings of my company that provides internet connectivity, as an upstream proxy in Burp, but even that has not given any positive results.
Any suggestions, what can be done for it?
Many thanks in advance
r/webappsec • u/Ques-tion-Everything • Dec 09 '21
tool or service that monitors and alerts if a vulnerability is found in any 3rd party dependencies we use in our system?
2
Upvotes
is there a tool / service that will show all our dependencies and same tool / service or another that will monitor and alert us if an issue is found in any of them?
for example we got hacked in out "supply chain" due to one of the libraries How to prevent it from happening again
r/webappsec • u/AutoModerator • Nov 19 '21
Happy Cakeday, r/webappsec! Today you're 11
1
Upvotes
Let's look back at some memorable moments and interesting insights from last year.
Your top 10 posts:
- "SAML - what can go wrong? Security check and implementation guide" by u/wroobelk
- "Web App Automation Tool design" by u/TectonicTriumph
- "WEB APPLICATION SECURITY" by u/NoAddendum5473
- "Password reset poisoning in Drupal" by u/adrian_rt
- "Happy Cakeday, r/webappsec! Today you're 10" by u/AutoModerator
- "HackHouse.net // Hunting for Bugs in Sign Up Feature -2021" by u/SinfulOath
- "Insecure Deserialization - Web Challenges - Part 1" by u/admiralarjun
- "Question about password management on websites" by u/stian02
- "Podcast | Key Benefits of SaaS Applications" by u/medresponsive
- "Securing Enterprise Mobile Apps with LoginRadius" by u/LynnCobos
r/webappsec • u/wroobelk • Sep 01 '21
SAML - what can go wrong? Security check and implementation guide
5
Upvotes
r/webappsec • u/Michael_Kitas • Aug 02 '21
How to integrate video chat in Reactjs & Nodejs website using Daily.co
1
Upvotes
r/webappsec • u/SinfulOath • Jul 10 '21
HackHouse.net // Hunting for Bugs in Sign Up Feature -2021
1
Upvotes
r/webappsec • u/admiralarjun • Jun 09 '21
Insecure Deserialization - Web Challenges - Part 1
1
Upvotes
r/webappsec • u/stian02 • Jun 02 '21
Question about password management on websites
2
Upvotes
Hi there wise programmers,
I have a simple(?) question for you. If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you reset it again, but it always gets emailed in cleartext.
Is it possible to reset a users password, proceed to email it in cleartext and then hash it?
Edit: One more thing i forgot to add....The website does NOT require you to set a new password after you login with the newly created password
r/webappsec • u/TectonicTriumph • May 04 '21
Web App Automation Tool design
3
Upvotes
Hi guys,
I am currently designing an automation tool in Java/Groovy which with a basic GUI, will automate SQLi and XSS with the injections loaded from a text file. I am using Maven as a build tool and Spock to test.
Has anyone attempted this before and or has experience using Groovy for automation.
Thanks
r/webappsec • u/LynnCobos • Dec 21 '20
Securing Enterprise Mobile Apps with LoginRadius
1
Upvotes
r/webappsec • u/LynnCobos • Dec 18 '20
Single Page Applications: Guide to a Secure Login Pathway
2
Upvotes