Netsparker's Web Application Security Blog

Netsparker Will Be Sponsoring and Exhibiting at the PHPKonf 2019 in Istanbul

Category: Events - Last Updated: Thu, 11 Apr 2019 - by Daniel Bishtawi
Netsparker Will Be Sponsoring and Exhibiting at the PHPKonf 2019 in Istanbul

This May, our team will be exhibiting the Netsparker Web Application Security Scanner at PHPKonf 2019 in Istanbul. We are also sponsoring the event, and one of our security researchers is delivering a talk. Visit us to answer questions about automatically detecting vulnerabilities or to learn more about Netsparker, our dead accurate web security scanner. Read More

WordPress XSS Vulnerability Can Result in Remote Code Execution (RCE)

Category: Web Security Readings - Last Updated: Tue, 09 Apr 2019 - by Ziyahan Albeniz
WordPress XSS Vulnerability Can Result in Remote Code Execution (RCE)

This article discusses vulnerabilities in older versions of WordPress due to its pingback and trackback features, and flawed sanitizing mechanism. It describes how attackers can use HTML tags to bypass sanitizing and insert an XSS payload using the WordPress flaw. Finally, it concludes with advice on how to fix the vulnerability in WordPress. Read More

Announcing the Deobfuscating JavaScript White Paper

Category: Web Security Readings - Last Updated: Thu, 04 Apr 2019 - by Netsparker Security Team
Announcing the Deobfuscating JavaScript White Paper

This blog post announces the publication of a White Paper called Deobfuscating JavaScript Code: A Steam Phishing Website, which examines a real world example of obfuscation in a phishing page that aimed to steal Steam Account credentials. It charts the different phases and techniques used in the unobfuscation process, as the code is cleaned. Read More

Netsparker 5.3 – Scan Performance Upgrades

Category: Web Security Readings - Last Updated: Wed, 03 Apr 2019 - by Dogan Aydos

Netsparker 5.3 contains new scan performance upgrades that allocate computer resources better. Instead of users controlling concurrent activities, they are now controlled dynamically throughout the scan by Netsparker, based on the Requests Per Second. This will increase scan speed by allowing more activities simultaneously, without pauses or blocks. Read More

Application Security is Vital Throughout SDLC

Category: Web Security Readings - Last Updated: Tue, 02 Apr 2019 - by Ziyahan Albeniz
Application Security is Vital Throughout SDLC

Research shows that developers must be directed to write secure code and don’t have enough information about security, often copying and pasting code from the internet. This blogpost examines weak ways to store user passwords, warning that strong algorithms may not be enough for security, and provides advice on how to store passwords securely. Read More

March 2019 Update for Netsparker Standard

Category: Releases - Last Updated: Thu, 28 Mar 2019 - by Netsparker Security Team

This blog post announces the March 2019 update for Netsparker Standard. Highlights are Scan Policies for PCI and OWASP Top Ten. Other new features are: Netsparker Assistant; scan performance upgrades; OAuth2 authentication; added Integration options for Azure DevOps, Redmine and Bugzilla; a Best Practice Severity Level; and RESTful API features. Read More

Behind the Scenes of Onion Services

Category: Web Security Readings - Last Updated: Fri, 22 Mar 2019 - by Ziyahan Albeniz
Behind the Scenes of Onion Services

Tor is an anonymity network that provides so-called onion services so that users can hide their locations. This article explains how to start a Tor service and change your domain name. It examines research on the security risks of regular onion domains, the user habits on Tor services, and possible fixes and updates for security concerns. Read More

Transforming Self-XSS Into Exploitable XSS

Category: Web Security Readings - Last Updated: Thu, 14 Mar 2019 - by Ziyahan Albeniz
Transforming Self-XSS Into Exploitable XSS

This blog is describes an attempt by a security researcher to exploit a Cross-site Scripting (XSS) vulnerability. It explains the importance of template strings – including multi-line strings and tagged templates – in XSS filtering, how to overcome the document.domain issue, and the discovery and exploitation of Self-XSS, with reading suggestions. Read More

The End of CoinHive and the Rise of Cryptojacking

Category: Web Security Readings - Last Updated: Thu, 07 Mar 2019 - by Ziyahan Albeniz
The End of CoinHive and the Rise of Cryptojacking

Cryptojacking is the unauthorized use of a computer to mine cryptocurrency. This article traces the development of Cryptojacking from ByteCoin and Monero, used by the CoinHive service. It examines how Cryptojacking works, the latest research, and content security policy solutions that limit source loading and report Cryptojacking scripts. Read More

Sound Hijacking – Abusing Missing XFO

Category: Web Security Readings - Last Updated: Thu, 28 Feb 2019 - by Ziyahan Albeniz
Sound Hijacking – Abusing Missing XFO

This article examines a new attack on Google Docs called Sound Hijacking, which leads to the takeover of users’ audio input devices. We investigate how the attack works and conclude with an evaluation of the importance of the X-Frame-Options Header for the attack and information on which browsers support it. Read More

PCI Scanning Announcement

Category: News - Last Updated: Tue, 26 Feb 2019 - by Gokhan Demir

From February 2019, Netsparker Enterprise will be able to conduct fully approved compliance scans to check the security of your public websites against Payment Card Industry (PCI) Security Standards Council requirements. If your websites pass, you will receive a compliance report. PCI scans are managed alongside regular Enterprise security scans. Read More

Brave Browser Sacrifices Security

Category: Web Security Readings - Last Updated: Thu, 21 Feb 2019 - by Ziyahan Albeniz
Brave Browser Sacrifices Security

Brave is a browser that blocks ads and website tracking to improve user privacy and security. This blog post describes a controversial update to Brave that contained a whitelist of tracking URLs, causing online discussions, and a temporary but active solution. This blog examines some key terms and suggests how Brave could learn from Firefox. Read More

Phishing by Open Graph Protocol

Category: Web Security Readings - Last Updated: Thu, 07 Feb 2019 - by Ziyahan Albeniz
Phishing by Open Graph Protocol

Open Graph Protocol (OGP) was introduced by Facebook to highlight shared links in social media platforms. Phishing attacks use OGP to deceive users into clicking links that redirect them to other websites. This blog post explains what the OGP looks like, discusses phishing attack research and finally lists some precautions to take against them. Read More

Remote Hardware Takeover via Vulnerable Admin Software

Category: Web Security Readings - Last Updated: Tue, 29 Jan 2019 - by Ziyahan Albeniz
Remote Hardware Takeover via Vulnerable Admin Software

This article focuses on new research into potential remote hardware takeover vulnerabilities in admin software. These vulnerabilities occur due to a lack of control mechanisms, which enables potential WebSocket Hijacking attacks. The article explains how these attacks work, how to prevent them, and the importance of a content security policy header. Read More

Cross Site Cookie Manipulation

Category: Web Security Readings - Last Updated: Thu, 24 Jan 2019 - by Ziyahan Albeniz
Cross Site Cookie Manipulation

This article examines the security of PHP's session cookies in a shared hosting environment, and explains why a cryptographically secure, random session ID is not enough to prevent attacks. It explains how PHP handles cookies and how the session management feature initializes in PHP. Finally, it provides an attack demo and advice for prevention. Read More

January 2019 Update for Netsparker Enterprise

Category: Releases - Last Updated: Wed, 23 Jan 2019 - by Gokhan Demir

This blog post announces the new features in the latest Netsparker Enterprise release of January 2019. Highlights include: the addition of a new Application/Service Discovery feature; JIRA, FogBugz, GitLab, Azure and Jenkins Integration features; Support for Advanced Scheduling Scenarios; and further Security Checks. Read More