Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

learn more… | top users | synonyms (1)

-1
votes
1answer
22 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
2
votes
1answer
95 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
85
votes
5answers
10k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are: CVE-2010-...
6
votes
2answers
136 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
1
vote
1answer
23 views

Security in transferring sensitive data over web apps

I am working on an app that has to transfer sensitive data over HTTPS and I have an idea but I am wondering if it is overkill or good. One of the issues is I need the ability to "share data" between ...
6
votes
4answers
5k views

How to harden an iPhone/Android app so it's tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
1
vote
1answer
25 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
2
votes
2answers
193 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
0
votes
1answer
42 views

What more can I do to secure my service?

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to ...
0
votes
1answer
21 views

Anti CSRF tokens with a black box

Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and ...
8
votes
3answers
696 views

How to protect contact forms against being misused for mass-mailing?

A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form ...
3
votes
1answer
42 views

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
14
votes
2answers
2k views

Split an application into user and admin parts for security reasons?

I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/...
4
votes
1answer
235 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
0
votes
1answer
102 views

OSSIM - How do I not receive events from alienvault-host?

How do I not receive events related to the server itself OSSIM? Example: SSH Accept Key alienvault[SRC] -------> ServerToMonitor[DST] PS:I've taken all the rules of OSSEC, then the ...
55
votes
5answers
174k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
-2
votes
1answer
67 views

Best way to control who can run my application? [closed]

I am planning to make an application and I don't want everyone to use it (only allowed people). What I was going to do is getting the MAC address of the user and add it to our database "allowed_users" ...
14
votes
4answers
8k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
0
votes
1answer
189 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered?
2
votes
0answers
24 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
1
vote
1answer
57 views

Security of a desktop application's source code [closed]

How easy is it to get the source code from a desktop application? Are there any protections in place to stop someone from viewing an application's code?
20
votes
4answers
8k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
4
votes
1answer
72 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
2answers
89 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
0
votes
1answer
37 views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
-4
votes
1answer
60 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
4
votes
2answers
73 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
0answers
114 views

Security Questions I should be asking my developers [closed]

I am looking for a comprehensive list of security related questions I should be asking my developers. I have done some research on the net and have yet to find a great list of questions I should be ...
1
vote
1answer
92 views

How can I protect named pipes in windows?

I have some misunderstanding regarding how to secure the communication of named pipes in windows For example, I have a windows service that talks with other processes via pipes, how can I make sure ...
1
vote
0answers
36 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
69
votes
19answers
5k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
0
votes
1answer
21 views

What bytes are stripped by info-zip?

I see many software that check only for..between path separators. For a long time I thought they were no possibility to exploit invalid bytes (for example attempt to create.‌.will lead to.?.on osx). ...
2
votes
2answers
49 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
3
votes
2answers
96 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g.,...
1
vote
1answer
32 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
5
votes
3answers
316 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
9
votes
2answers
128 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
1answer
54 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
3
votes
2answers
1k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
1
vote
2answers
134 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
4
votes
2answers
400 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What data/...
1
vote
2answers
106 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or www.xyz.com/user?fname="abc"&lname="...
0
votes
0answers
35 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
3
votes
2answers
66 views

Risks of using a webpage without SSL/TLS for donations

There is a site called www.mysite.com. It uses Qgiv for taking donations and has some HTML5 data-attributes like: <div class="qgiv-embed-container visible-lg-block" > data-qgiv-embed="true" ...
5
votes
3answers
659 views

OWASP Top 10? How about OWASP Top 1000?

Many people are aware of the "OWASP Top 10". I'm wondering if OWASP (or any similar authority) has gone above and beyond just the top 10 most commons attacks and made a larger list (e.g. the "OWASP ...
1
vote
2answers
59 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
1
vote
0answers
21 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
-3
votes
5answers
86 views

What does it mean to secure something in computer security? [closed]

Can someone provide a formal and simple definition of "to secure something" in information security?
2
votes
1answer
32 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...