Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
1
vote
1answer
128 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
1
vote
1answer
55 views
sigsegv in php5.3.10
I found an overflow situation in php5.3.10.
Probably it's not 'something new', but if I can understand this,
it will help me to find this kind of bug faster in the future.
What can I do to check ...
1
vote
4answers
380 views
Is it necessary to scan users' file uploads by antivirus?
Web application allows users to upload files. Is it necessary to scan those files by antivirus?
I'd want to hear answer in two scenarios:
Type of file isn't checked when uploading. They are stored ...
7
votes
4answers
161 views
Limited JavaScript app scenario: Attack vectors and mitigation
I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
0
votes
2answers
633 views
IS Maltego is the best forensic/intelligence solution out there? [closed]
i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web .
please recommend me the best software out there ... and if you ...
10
votes
3answers
205 views
Application security training for developers
I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
4
votes
2answers
315 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
0
votes
0answers
148 views
GWAPT - Training Experiences/Questions [closed]
I'm heavily considering the GWAPT certificate, I'm wondering:
http://www.giac.org/certification/web-application-penetration-tester-gwapt
Has anyone done the online version of it? What is it like? Is ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
-1
votes
1answer
101 views
Mac app purchase validation
How do I sell a mac app off of my website without somebody being able to copy-and-paste the app to some friends after he buys it, etc..
I understand that you can use receipt validation when selling ...
3
votes
2answers
276 views
Added security risks that come with 3-tier software architecture
Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project?
I got asked this today, and my gut reaction was "I don't see why there would be." ...
3
votes
1answer
71 views
Is it possible to verify identity of site that sent request to you?
I'm developing a JS widget that can be embedded by 3rd party websites. When widget is shown, it sends request to my site. When this request is received, I know that it was shown to the user and pay ...
7
votes
5answers
392 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
2
votes
2answers
90 views
Secure Spring FrameworkUser Management
I got asked this question:
"Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)?
How do you guys do authz in Spring, including managing those roles ...
1
vote
2answers
69 views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
4
votes
1answer
151 views
How to use postMessage securely
postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication.
What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
5
votes
4answers
564 views
Protecting against CSRF when a form is being submitted via an AJAX call
I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
3
votes
2answers
323 views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
5
votes
3answers
330 views
How does KeePass master key derivation increase security?
I don't understand how KeePass key derivation increases the security of the password db at all.
First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
10
votes
3answers
548 views
Tools to help test the security of Android applications
What are some decent frameworks to test the security of Android applications?
With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
8
votes
2answers
503 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
2
votes
5answers
115 views
Documentation Platforms for Information Security Team
I am looking for ideas on documentation platforms focused specifically for information security and response teams. Is there anything that has worked well? What are some of the unique advantages of ...
5
votes
4answers
298 views
Automating Social Engineering Prevention
Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
4
votes
2answers
302 views
Canonicalization & Output Encoding
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
If any potentially hazardous characters (<>"'%()&+\\'\") ...
4
votes
2answers
386 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
2
votes
2answers
105 views
Is this logic security / performance wise or not?
Each physical user will have about 20 tables in the database.
When a new user registers, another 20 tables will be created with access only for their new MySQL account.
Data does not have to be ...
1
vote
1answer
53 views
Dangers of a vulnerability in a local installer?
I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.
Other than the fact that if ...
-4
votes
4answers
257 views
Should companies use Crowd Source Audit Platform for Manual Penetration Test?
As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues?
LE: So most of you guys downgrade, and said it's wrong to have ...
1
vote
2answers
189 views
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
0
votes
2answers
339 views
Where is future of computer security? [closed]
I know its kind of a "hard to answer" question, but I was thinking, googling and reading about it for a week and I still can't make a decision. So, where do you think the future of computer security ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
7
votes
2answers
848 views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
1
vote
5answers
382 views
Security risks of hosting user-supplied images?
I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc...
I will fetch these files and store them, they will be shown to users in a gallery ...
2
votes
5answers
281 views
Can web application do anything to prevent risk from client-side malware?
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
2
votes
1answer
84 views
Types of attacks outside of AppSec and Vendor-Specific Systems?
I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
4
votes
2answers
227 views
OWASP Top 10? How about OWASP Top 1000?
Many people are aware of the "OWASP Top 10". I'm wondering if OWASP (or any similar authority) has gone above and beyond just the top 10 most commons attacks and made a larger list (e.g. the "OWASP ...
5
votes
1answer
115 views
Should an app remove or encrypt locally stored user data after a user logs out?
I’ve been poking around in the Application Support folder of a popular app, trying to extract some chat logs. (By “popular”, I mean that most people reading this will have heard of it. I’m not sure if ...
9
votes
2answers
381 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
4
votes
2answers
151 views
Recommendations for documenting security code review
How should I document the results of a security code review?
Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
1
vote
1answer
130 views
Limiting database security
A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
1
vote
1answer
315 views
LFI or RFI from XSS?
Could XSS lead us to the Local File Include or Remote File Include?
I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.
1
vote
1answer
181 views
JS frontend for RESTful backend vs authorization
I'm building web-app. And i have concern about security issues.
In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
3
votes
2answers
396 views
List of Top security risk/attack scenarios for android application
WHat are the possible security risk/attack scenarios for android application.
This is with regards to the OWASP top 10 Mobile Security threats discussed here:
...
0
votes
3answers
402 views
Can people use AES VPN tunnels to hide their activities from authorities?
I have read an article about programmers who use AES VPN tunnels when working remotely with clients from other countries. The article writes that this way their countries are unable to track their ...
1
vote
1answer
402 views
Example of attack trees in the web application security analysis
Here I am again asking for some informations about attack trees usage in web application analysis.
For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
1
vote
1answer
187 views
Using Tokens to Keep Users Logged In
I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
1
vote
2answers
257 views
Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
Imagine button after clicking which browser sends XHR http request with GET method. Characteristics:
after executing request sensitive action is performed
sensitive information is sent in GET ...
15
votes
2answers
2k views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
4
votes
3answers
294 views
Is there a security risk in existence of those HTTP headers in responses?
The following HTTP headers can be seen in responses on some sites:
Age: 12
Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==
Via: 1.1 tacoma:3128 (squid/2.7.STABLE9)
X-Cache: MISS from tacoma
X-Cache-Lookup: ...
12
votes
2answers
925 views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
