Netsparker's Web Application Security Blog

Web application security not only requires the detection of vulnerabilities but also their severity ranking. The Common Vulnerability Scoring System is an independent system that categorizes and grades vulnerabilities. This article examines the details of how CVSS works, provides examples, and explains how Netsparker uses CVSS in reports. Read More

From December 2018, Netsparker will report similar vulnerabilities in groups rather than individually. This means that vulnerability reports will be shorter, simpler and more accurate. It also means that the task of fixing vulnerabilities will take less time and effort. Read More

This blog post discusses the problems with DNS requests, whether they can be blocked using a firewall and how they compare with HTTP. It also examines a DNS-based file system proposed by Ben Cox designed to store files in the caches of DNS resolvers. Read More

jQuery is a JavaScript library that simplifies the process of writing code in JavaScript by making the element selectors, event chaining, and event handling easier. Since its inception, a large number of client-based libraries are dependent on jQuery. This article will examine the research on jQuery selectors. Read More

Our CEO, Ferruh Mavituna, explains why the framework you choose for your web applications matters. Even if you build the most secure application, when your framework is vulnerable, your application is too. He debunks some myths regarding the similarity of popular frameworks, and provides good reasons to check whether yours is secure by default. Read More

Netsparker will no longer support TLS 1.0 from 14 January 2019. This will affect all HTTPS traffic to Netsparker, including: software updates, the licensing process for Netsparker and vulnerability database updates. Netsparker requests that all users encountering issues should update their settings or contact Netsparker Support. Read More

This blog post announces the new features and improvements in the latest Netsparker Standard release of December 2018. Highlights include: a rewritten sitemap and issues panel, a new family vulnerabilities feature, added support for 64-bit smart card drivers and Swagger 3.0 Importer, and several send to integration additions. Read More

Session variables are server-side variables whose value is tied to the current session. They are an essential part of many web applications. Session-related vulnerabilities have a large impact on web application security. This article explores two vulnerabilities related to them: session puzzling and bypassing two-factor authentication. Read More

This article explains the origins of the Clickjacking Attack and how it works. It then examines how a researcher discovered a Clickjacking bug on Facebook and how Facebook responded to the Clickjacking attack. Finally, the article provides advice on how to prevent Clickjacking Attacks by using the X-Frame-Options HTTP security header. Read More

This article discusses research by Princeton and UC Berkeley on web-based attacks involving the Internet of Things (IoT) devices. These attacks were able to discover, hack and take control of IoT devices. We examine the duration and phases of these attacks, and conclude by suggesting some web security countermeasures. Read More

This January, our team will be exhibiting the Netsparker Web Application Security Scanner at OWASP AppSec California in January 2019. Read More

This article describes the details and logic behind a vulnerability that combines Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE) on routers. This combination can allow a hacker to discover and gain access to the machines within the network of a router. Content-Type Headers provide a critical role in security against it. Read More

In episode #584 of Paul's Security Weekly, Sven Morgenroth, a Netsparker security researcher, discusses PHP Object injection vulnerabilities and explains the dangers of PHP's unserialize function. Sven provides background on PHP Objects, demos how to write an exploit for a PHP Object Injection vulnerability, and explains how to prevent them. Read More

At the end of 2018, PHP will stop security updates and support for some of its previous versions. This will expose hundreds of millions of websites to serious risk in terms of sites hacked, user details stolen, and massive fines. You need to update, and use systems that allow you to deploy only new versions of PHP by default. Read More

Netsparker announces a new feature for Netsparker Enterprise that acts as an application and service discovery tool. Netsparker Radar – Application & Service Discovery Service enables you to locate your enterprise's online collateral, websites and services, which you can then add to Netsparker to scan, helping you reduce threats and increase security. Read More

Netsparker announces a new integration capability between Netsparker Enterprise and GitLab. GitLab is a web-based Git repository manager that provides CI/CD pipeline features, enabling you to add CI configuration to your source control using just one file, and gain access to our advanced integration functionality. Read More

This blog post includes a discussion of URLs, their structure, how they can contain sensitive information and why it's so difficult to parse them without introducing vulnerabilities. We include an example of how a parsing error led to a Window Opener Protection Bypass. Read More

In this article, our Security Researchers examine the explicit code of the disabled system functions bypass, including the parameters of the imap_oprn function, the IMAP server types and SSH connection, and the -oProxyCommand in the exploit. They conclude with some methods to protect yourself against this bypass method. Read More

In this blog post, we discuss the research on Fragmented SQL Injection where the hackers control two entry points in the same context in order to bypass the authentication form. Our security researcher looks at the importance of single quotes in the SQL injection attacks and the solution, Prepared Statements, also known as Parameterized Queries. Read More

This blog post explains how the Tor network, selected for anonymity, can actually be used to discover users' IP addresses due to an incorrect SSL configuration. It includes examples, screenshots and recommendations for further reading. Read More