Specific to securing an application rather than the connection, infrastructure, browser etc
3
votes
2answers
63 views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
0
votes
0answers
7 views
How does a company set up a private App store for BYOD scenarios? [migrated]
This answer mentions that it's possible for a corporation to set up a private App Store for iPhone, Android and possibly other devices.
How is this possible, and how can one implement this?
3
votes
3answers
89 views
Is there a security risk in existence of those HTTP headers in responses?
The following HTTP headers can be seen in responses on some sites:
Age: 12
Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==
Via: 1.1 tacoma:3128 (squid/2.7.STABLE9)
X-Cache: MISS from tacoma
X-Cache-Lookup: ...
5
votes
2answers
179 views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
0
votes
1answer
27 views
Set Cookie in XHR response : How different browsers handle this?
If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response.
How different browsers handle this?
Does any version of any browser set the cookie for ...
0
votes
1answer
82 views
Web Service Security
We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security:
An SSL Certification to the service for the ...
3
votes
4answers
189 views
XSS : Content-type: application/json
Background information
- Application responds to request to a particular URL with content-type: application/json
JSON response contains a parameter from the request
Escapes the quote with a slash
...
1
vote
0answers
40 views
Device authentication and user authentication [closed]
I need to design a system where:
I need to authenticate the device
Authenticate the user
I am thinking of using device authentication using a digital certificate and user authentication using user ...
1
vote
2answers
102 views
Is traffic sent by Mouse Without Borders encrypted?
Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
7
votes
6answers
343 views
Where to start with security testing?
Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
1
vote
2answers
96 views
Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]
What professional standards and practices are recommended for guiding such an effort?
1
vote
5answers
173 views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
5
votes
2answers
124 views
Established Security Design Patterns?
In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
1
vote
2answers
88 views
Is DIGEST-MD5 secure if done over HTTPS?
If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?:
Digest access authentication is intended as a security ...
5
votes
2answers
113 views
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
1
vote
1answer
163 views
How to use OAuth with Active Directory
I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
6
votes
4answers
213 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
4
votes
5answers
255 views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
2answers
122 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
3
votes
2answers
54 views
Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?
I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
0
votes
2answers
152 views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
1
vote
1answer
175 views
Why should crossdomain.xml be present if user-uploaded files exist?
In his book Michal Zalewski says:
To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
11
votes
7answers
385 views
If I include a Forgot Password service, then what's the point of using a password?
I've implemented a Forgot Password service in the following way:
User goes to login page, clicks on "Forgot password?"
User is presented with a form that asks for their email address.
Email is sent ...
2
votes
2answers
67 views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
1
vote
4answers
152 views
Without using SSL, what's the most secure way to make an AJAX request to a PHP page?
It was suggested over at stackoverflow that I try my question here. This is it verbatim:
So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
3answers
98 views
What security standards should be implemented in a simple web application
I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
5
votes
3answers
185 views
What fraction of web sites are vulnerable?
It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
0
votes
3answers
170 views
Securing dropdown boxes
I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured.
...
1
vote
3answers
114 views
Smartphone SSH clients with shared user
I am writing an application for smartphones to provide very limited SSH usage. The user cannot perform arbitrary actions when logged in. They can run a specific script(s) only.
For various reasons ...
7
votes
2answers
270 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
1
vote
0answers
216 views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
3
votes
2answers
45 views
Changing windows client form values at runtime
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
1
vote
1answer
144 views
Web application software architecture: basic security
I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer.
Let's say I have three components of a ...
4
votes
3answers
148 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
2
votes
2answers
67 views
For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
11
votes
1answer
293 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
9
votes
4answers
226 views
Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?
Background
We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
4
votes
2answers
110 views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
3
votes
2answers
146 views
How to store IV and key temporarily but securely
I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
7
votes
2answers
157 views
Should I store my intellectual property / code online?
As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much ...
6
votes
2answers
83 views
What to consider when generating random code as part of two-factor authentication?
I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
2
votes
2answers
190 views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
2
votes
1answer
92 views
Tomcat IP restriction vs Two Legged OAuth
We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
0
votes
1answer
33 views
Is there a grading standard for security that I can apply to my MVC3 web site?
I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list ...
3
votes
4answers
180 views
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Let's say I develop an application that,
Allows any user to upload a file of only white listed mime content type and extensions (word and pdf).
Serves those files with the allowed extension and ...
4
votes
2answers
183 views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
0
votes
0answers
77 views
How to license my web application for schools? [closed]
I have a web application which I am interested in start selling it for schools, but, until now, I didn't find a proper solution for licensing it for schools.
Can some one please guide me for a ...
0
votes
1answer
170 views
Iphone App Pen Test Guidance [closed]
I'm going to be studying pentesting iPhone apps. I'm a beginner in this area, and would like some guidance on the prerequisites of pen testing an iphone app, the details of the Mac machine that I'd ...
3
votes
4answers
323 views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
5
votes
1answer
182 views
question for pentesters: PHP proc_open() in safe_mode
Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?
As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
