Netsparker's Web Application Security Blog

This blog post examines Frame Injection attacks. It describes briefly the history of the invention and development of frames, what Frame Injection attacks and hijacks mean in terms of security, and what you can do to prevent them. It also compares Frame Injection attacks with Cross-site Scripting, which is often a priority for bug bounty hunters. Read More

Netsparker security researcher Sven Morgenroth was interviewed on Application Security Weekly #60 to discuss how to build applications that are secure by default, so that some of the most common vulnerabilities are automatically avoided. Read More

The SameSite cookie attribute is used by browsers to control cookie requests and increase security. This article explains what the SameSite cookie attribute is and the different security levels to which it applies. It also describes upcoming changes to the Same Site attribute on Chrome and the new ‘Cookies without SameSite must be secure’ feature. Read More

This blog post examines what robot.txt standards are and how they work. It then discusses the role of custom URIs in mobile application data transfers. It evaluates the security mechanism invented by the Apple-App-Site-Association (AASA). Finally, it sketches out the future and security of AASA. Read More

This article examines how Facebook has stored hundreds of millions of users’ passwords in plain text since 2012. On Hack Naked News #212, Netsparker security researcher Sven Morgenroth talks about the origin of this news story, the statistics involved, the security problems it has created for Facebook and its users, and what they can do about it. Read More

This blog post explores the issue of content-type and status code leakage. It examines the meaning of HTTP status codes and their effect when used with HTML attributes. The typemuchmatch HTML attribute receives special attention. It also explains how to prevent data leaks, and emphasizes the importance of correct implementation. Read More

Ferruh Mavituna is interviewed about Netsparker by Help Net Security. The interview focuses on how Netsparker accurately identifies web application vulnerabilities without false positives using its unique Proof-Based technology, prioritizes fixes, prevents bottlenecks in development, discovers services, and deals with the growing problem of scalability. Read More

From March 2019, Netsparker Standard will support the OAuth2 authentication framework. This new feature means that users will now be able to configure scans for websites that require OAuth2 authentication. This is one of the March 2019 Updates for the new release of Netsparker Standard 5.3. Read More

This article explains the three different types of cross-site scripting (XSS) vulnerability. It also uses examples to highlight how attackers can exploit such vulnerability and what you, as a developer can do to prevent XSS Vulnerabilities in your web applications. Read More

Setting cookies on domains with multiple subdomains opens them up to security risks such as session fixation attacks. This article describes the purpose of cookies on websites with multiple domains, provides a demonstration of the sandbox attribute by the use of examples, and explains the advantages of the CPS sandbox attribute. Read More

This May, our team will be exhibiting the Netsparker Web Application Security Scanner at PHPKonf 2019 in Istanbul. We are also sponsoring the event, and one of our security researchers is delivering a talk. Visit us to answer questions about automatically detecting vulnerabilities or to learn more about Netsparker, our dead accurate web security scanner. Read More

This article discusses vulnerabilities in older versions of WordPress due to its pingback and trackback features, and flawed sanitizing mechanism. It describes how attackers can use HTML tags to bypass sanitizing and insert an XSS payload using the WordPress flaw. Finally, it concludes with advice on how to fix the vulnerability in WordPress. Read More

This blog post announces the publication of a White Paper called Deobfuscating JavaScript Code: A Steam Phishing Website, which examines a real world example of obfuscation in a phishing page that aimed to steal Steam Account credentials. It charts the different phases and techniques used in the unobfuscation process, as the code is cleaned. Read More

Netsparker 5.3 contains new scan performance upgrades that allocate computer resources better. Instead of users controlling concurrent activities, they are now controlled dynamically throughout the scan by Netsparker, based on the Requests Per Second. This will increase scan speed by allowing more activities simultaneously, without pauses or blocks. Read More

Research shows that developers must be directed to write secure code and don’t have enough information about security, often copying and pasting code from the internet. This blogpost examines weak ways to store user passwords, warning that strong algorithms may not be enough for security, and provides advice on how to store passwords securely. Read More

We announce the Netsparker Standard 5.3 update, released in March 2019. Highlights are Scan Policies for PCI and OWASP Top Ten. Other new features are: Netsparker Assistant; scan performance upgrades; OAuth2 authentication; added Integration options for Azure DevOps, Redmine and Bugzilla; a Best Practice Severity Level; and RESTful API features. Read More

Tor is an anonymity network that provides so-called onion services so that users can hide their locations. This article explains how to start a Tor service and change your domain name. It examines research on the security risks of regular onion domains, the user habits on Tor services, and possible fixes and updates for security concerns. Read More

This blog is describes an attempt by a security researcher to exploit a Cross-site Scripting (XSS) vulnerability. It explains the importance of template strings – including multi-line strings and tagged templates – in XSS filtering, how to overcome the document.domain issue, and the discovery and exploitation of Self-XSS, with reading suggestions. Read More

Cryptojacking is the unauthorized use of a computer to mine cryptocurrency. This article traces the development of Cryptojacking from ByteCoin and Monero, used by the CoinHive service. It examines how Cryptojacking works, the latest research, and content security policy solutions that limit source loading and report Cryptojacking scripts. Read More

The HTML autocomplete feature improves user experience but contains security risks. This blog post describes the technical elements of the autocomplete attribute, and provides examples of dangerous, improper usage. It concludes with research on the statistics of autocomplete failure in browser behaviour tests with some popular browsers. Read More