Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

learn more… | top users | synonyms (1)

1
vote
1answer
18 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
0
votes
1answer
28 views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
-4
votes
1answer
55 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
3
votes
2answers
65 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
0answers
108 views

Security Questions I should be asking my developers [closed]

I am looking for a comprehensive list of security related questions I should be asking my developers. I have done some research on the net and have yet to find a great list of questions I should be ...
1
vote
1answer
58 views

How can I protect named pipes in windows?

I have some misunderstanding regarding how to secure the communication of named pipes in windows For example, I have a windows service that talks with other processes via pipes, how can I make sure ...
1
vote
0answers
35 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
0
votes
1answer
21 views

What bytes are stripped by info-zip?

I see many software that check only for..between path separators. For a long time I thought they were no possibility to exploit invalid bytes (for example attempt to create.‌.will lead to.?.on osx). ...
3
votes
2answers
84 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set ...
2
votes
2answers
43 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
1
vote
1answer
30 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
8
votes
2answers
119 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
1
vote
2answers
106 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or ...
0
votes
0answers
29 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
3
votes
2answers
66 views

Risks of using a webpage without SSL/TLS for donations

There is a site called www.mysite.com. It uses Qgiv for taking donations and has some HTML5 data-attributes like: <div class="qgiv-embed-container visible-lg-block" > data-qgiv-embed="true" ...
1
vote
2answers
57 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
1
vote
0answers
18 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += ...
0
votes
1answer
52 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
-3
votes
5answers
86 views

What does it mean to secure something in computer security? [closed]

Can someone provide a formal and simple definition of "to secure something" in information security?
2
votes
1answer
27 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
2
votes
1answer
41 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
5
votes
2answers
147 views

Best practices for automatic login URL's?

An automatic login URL is a mechanism whereby an existing but logged out user of your website or application can click a link with a random token and be automatically recognized and logged-in to your ...
-4
votes
1answer
33 views

Tendency towards security-is-binary in cryptography [closed]

In the real (physical) world, we seem to feel secure with just enough security, e.g.: Our door lock isn't the most secure. Anyone can lock-pick / break with force. Our car isn't the most robust. ...
-4
votes
1answer
42 views

Can secure HTTP headers like be ignored for js and static HTML pages?

I am performing a security scan on a website and the ZAP tool reports some secure headers are missing for js and static HTML pages. Is it ok to ignore the alerts ?
2
votes
3answers
75 views

Can a curl request to an arbitrary url made sufficiently safe?

This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?) on which I am doing some private research. Given: A publicly reachable webservice that ...
0
votes
0answers
43 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network ...
2
votes
2answers
66 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
2
votes
0answers
181 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
6
votes
2answers
117 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
7
votes
3answers
647 views

How to protect contact forms against being misused for mass-mailing?

A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measurements to protect against the form ...
14
votes
2answers
934 views

What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?

It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
-4
votes
1answer
41 views

Testing a Developed Web application - any tips? [closed]

I developed a web application mostly in PHP and JavaScript with a bit of AJAX. I do not have pentesting experience, but I like to try a few tools like sqlmap on it to see if I have any flaws in my ...
1
vote
1answer
52 views

Security implications of exposed Dropbox API key and secret

I've noticed that the Dropbox PHP SDK requires you to put your API credentials in a JSON file that might be publicly available if the SDK code is placed within the DOCUMENT_ROOT directory. What are ...
1
vote
0answers
83 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
4
votes
4answers
104 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
3
votes
1answer
62 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
1
vote
3answers
73 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
0
votes
1answer
957 views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
0
votes
1answer
148 views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
0
votes
0answers
85 views

Buffer overflow, unable to overwrite return address

I can't write over return address completely and I don't know why. Here is gdb when I put 30 'A's: Stopped reason: SIGSEGV 0x00000a4141414141 in ?? () It overwrites RIP but not completely, so I ...
1
vote
0answers
1k views

How do I view the signature of an iOS application?

OSX had an issue where the certificate was expired and several apps could not be opened after that date. The command above illustrates how this could have been detected. Does iOS have a similar ...
1
vote
2answers
141 views

Security Benefits in Replacing Windows Desktop Programs with New Windows Store Apps for Higher-Risk Uses?

Question: I'll put this as concretely as I can: For a small business-owning user of a Windows 10 PC who's highest-security-risk activities involve opening plenty of email attachments of PDF and ...
0
votes
1answer
78 views

OSSIM - How do I not receive events from alienvault-host?

How do I not receive events related to the server itself OSSIM? Example: SSH Accept Key alienvault[SRC] -------> ServerToMonitor[DST] PS:I've taken all the rules of OSSEC, then the ...
2
votes
2answers
103 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
3
votes
3answers
97 views

Best way to secure healthcare data in DB?

Original post : https://laracasts.com/discuss/channels/general-discussion/best-way-to-secure-healthcare-data-in-db Hi, I have a problem dealing with high secure/sensitive (healthcare) data. I know ...
1
vote
0answers
106 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
3
votes
3answers
165 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...