Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

learn more… | top users | synonyms (1)

-1
votes
1answer
24 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
1
vote
1answer
23 views

Security in transferring sensitive data over web apps

I am working on an app that has to transfer sensitive data over HTTPS and I have an idea but I am wondering if it is overkill or good. One of the issues is I need the ability to "share data" between ...
1
vote
1answer
25 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
0
votes
1answer
42 views

What more can I do to secure my service?

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to ...
3
votes
1answer
42 views

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
0
votes
1answer
21 views

Anti CSRF tokens with a black box

Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and ...
14
votes
2answers
2k views

Split an application into user and admin parts for security reasons?

I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/...
-2
votes
1answer
68 views

Best way to control who can run my application? [closed]

I am planning to make an application and I don't want everyone to use it (only allowed people). What I was going to do is getting the MAC address of the user and add it to our database "allowed_users" ...
2
votes
0answers
24 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
1
vote
1answer
57 views

Security of a desktop application's source code [closed]

How easy is it to get the source code from a desktop application? Are there any protections in place to stop someone from viewing an application's code?
4
votes
1answer
72 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
2answers
89 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
0
votes
1answer
38 views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
-4
votes
1answer
60 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
4
votes
2answers
73 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
0answers
114 views

Security Questions I should be asking my developers [closed]

I am looking for a comprehensive list of security related questions I should be asking my developers. I have done some research on the net and have yet to find a great list of questions I should be ...
1
vote
1answer
92 views

How can I protect named pipes in windows?

I have some misunderstanding regarding how to secure the communication of named pipes in windows For example, I have a windows service that talks with other processes via pipes, how can I make sure ...
1
vote
0answers
36 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
0
votes
1answer
21 views

What bytes are stripped by info-zip?

I see many software that check only for..between path separators. For a long time I thought they were no possibility to exploit invalid bytes (for example attempt to create.‌.will lead to.?.on osx). ...
3
votes
2answers
96 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g.,...
2
votes
2answers
49 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
1
vote
1answer
32 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
9
votes
2answers
128 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
1
vote
2answers
106 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or www.xyz.com/user?fname="abc"&lname="...
0
votes
0answers
35 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
3
votes
2answers
66 views

Risks of using a webpage without SSL/TLS for donations

There is a site called www.mysite.com. It uses Qgiv for taking donations and has some HTML5 data-attributes like: <div class="qgiv-embed-container visible-lg-block" > data-qgiv-embed="true" ...
1
vote
2answers
59 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
1
vote
0answers
21 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
0
votes
1answer
54 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
-3
votes
5answers
86 views

What does it mean to secure something in computer security? [closed]

Can someone provide a formal and simple definition of "to secure something" in information security?
2
votes
1answer
32 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
2
votes
1answer
44 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
5
votes
2answers
180 views

Best practices for automatic login URL's?

An automatic login URL is a mechanism whereby an existing but logged out user of your website or application can click a link with a random token and be automatically recognized and logged-in to your ...
-4
votes
1answer
36 views

Tendency towards security-is-binary in cryptography [closed]

In the real (physical) world, we seem to feel secure with just enough security, e.g.: Our door lock isn't the most secure. Anyone can lock-pick / break with force. Our car isn't the most robust. ...
-4
votes
1answer
47 views

Can secure HTTP headers like be ignored for js and static HTML pages?

I am performing a security scan on a website and the ZAP tool reports some secure headers are missing for js and static HTML pages. Is it ok to ignore the alerts ?
2
votes
3answers
82 views

Can a curl request to an arbitrary url made sufficiently safe?

This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?) on which I am doing some private research. Given: A publicly reachable webservice that ...
0
votes
0answers
46 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network stack ...
2
votes
2answers
67 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
2
votes
0answers
206 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
6
votes
2answers
137 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
8
votes
3answers
697 views

How to protect contact forms against being misused for mass-mailing?

A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form ...
14
votes
2answers
950 views

What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?

It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
-4
votes
1answer
42 views

Testing a Developed Web application - any tips? [closed]

I developed a web application mostly in PHP and JavaScript with a bit of AJAX. I do not have pentesting experience, but I like to try a few tools like sqlmap on it to see if I have any flaws in my ...
1
vote
1answer
66 views

Security implications of exposed Dropbox API key and secret

I've noticed that the Dropbox PHP SDK requires you to put your API credentials in a JSON file that might be publicly available if the SDK code is placed within the DOCUMENT_ROOT directory. What are ...
1
vote
0answers
98 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
4
votes
4answers
105 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
3
votes
1answer
62 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
1
vote
3answers
77 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
0
votes
1answer
1k views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...