Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
6
votes
4answers
858 views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
14
votes
4answers
743 views
What to transfer? Password or its hash?
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever).
Upon login, what should I transfer over the network and why? Password ...
8
votes
4answers
4k views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
7
votes
3answers
382 views
Finding security consultant for doing in-depth code review?
We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
6
votes
3answers
302 views
What is the next step of this file upload attack?
Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
6
votes
3answers
856 views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
5
votes
3answers
464 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
5
votes
2answers
584 views
Generating one-time tokens from API-key?
I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.
I intend to distribute secret API-keys to ...
4
votes
6answers
938 views
I want to be web security consultant?
If I want to be very good at security and especially web security, then must I learn languages? I mean things like PHP, C#, java, etc? If not then what should I learn exactly? and do you know any good ...
3
votes
4answers
647 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
3
votes
1answer
153 views
When does one need to be concerned with leaking timing information in .NET?
According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison.
When working with .NET crypto classes, when should ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
4
votes
0answers
637 views
Best website to learn computer security basics? [duplicate]
Possible Duplicate:
Resources to learn about security
Can someone advice on which are the good sites out there to learn the basics of computer security from?
3
votes
3answers
269 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
1
vote
2answers
450 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
4answers
372 views
Is it necessary to scan users' file uploads by antivirus?
Web application allows users to upload files. Is it necessary to scan those files by antivirus?
I'd want to hear answer in two scenarios:
Type of file isn't checked when uploading. They are stored ...
11
votes
1answer
1k views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
12
votes
7answers
815 views
SQL Injection Prevention
SQL Injection is always a hot topic particularly when it comes to web security.
In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
12
votes
3answers
390 views
Startup security
I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
52
votes
10answers
3k views
Does disabling right click have any impact on security?
On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
12
votes
6answers
525 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
18
votes
4answers
425 views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
17
votes
5answers
2k views
Where can I find a solid BURP tutorial?
I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
10
votes
2answers
462 views
Storing sensitive information securely
I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
5
votes
6answers
519 views
How do I secure my login page?
The login page is the starting point to any web site and the most important thing to authenticate the user.
When I begin to build any web application, I take a lot of time to think about how to ...
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
11
votes
5answers
972 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
9
votes
2answers
468 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
5answers
500 views
Code Review Strategies
As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
4
votes
1answer
84 views
Reading about security by design?
Security folks often encourage people to build security in from the start, and architect systems that are secure by design. What are some readings you would recommend for someone who wants to learn ...
16
votes
7answers
820 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
10
votes
5answers
697 views
Code Analysis: Binary vs Source
While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
10
votes
2answers
374 views
Detecting website attack attempts
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
7
votes
3answers
999 views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
19
votes
6answers
308 views
User input data, is filtering enough or should it be parsed?
In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...
15
votes
3answers
909 views
Why aren't applications sandboxed in Windows?
Sandboxing seem to be a way to restrict what an application can do. Today, I don't have much control of what my applications do with my computer. It feels more secure to use JavaScript based web ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
10
votes
5answers
822 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
4answers
438 views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
10
votes
2answers
808 views
10
votes
3answers
1k views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
8
votes
6answers
472 views
What is preventing the widespread common use of MAC-type systems?
Overall question
what is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments?
Why don't you think it isn't already widespread?
I do not ...
7
votes
2answers
755 views
Practical non-government uses of Biba, Bell-LaPadula, etc. models
For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
5
votes
4answers
646 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
3
votes
2answers
196 views
FrameBusting script
It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
12
votes
2answers
906 views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
