Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
11
votes
3answers
494 views
Getting a manual security code review done - What to watch out for?
We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process.
We did specify what kind of tests he should be ...
10
votes
2answers
689 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
9
votes
4answers
2k views
Session Hijacking - regenerate session ID
Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing?
I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
8
votes
2answers
588 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
8
votes
3answers
24k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
8
votes
7answers
916 views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
7
votes
5answers
587 views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
5
votes
4answers
1k views
Does default ModSecurity protect enough against XSS?
It's been a few years since I mucked around with modsecurity...
Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
11
votes
4answers
280 views
Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?
Background
We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
9
votes
2answers
2k views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
...
6
votes
7answers
533 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
3answers
171 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
6
votes
3answers
2k views
How much does a security audit cost?
For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC and I would probably use a North American company for testing. I really ...
5
votes
3answers
200 views
How safe are copies of Firefox that are on various Mozilla mirror sites?
If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added?
I don't see any mechanism for ...
5
votes
6answers
716 views
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code.
Sometimes though, the avoidance of ...
5
votes
1answer
354 views
Does sandboxie “grab” all the system calls?
Sandboxie: http://www.sandboxie.com
Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
5
votes
4answers
295 views
What is the solution to Schneier's Law?
Schneier's law (which should probably be called Babbage's Law). States that:
Anyone, from the most clueless amateur
to the best cryptographer, can create
an algorithm that he himself can't
...
4
votes
1answer
445 views
How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
What is CSRF?
I need a basic definition that is not just lifted from Wikipedia.
I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.
I am using a ...
3
votes
3answers
106 views
Encrypting a fixed format message with commands and transmitting over the internet
Linked to: Encrypting a fixed format message?
I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
3
votes
3answers
779 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
2
votes
3answers
782 views
AES for key encryption
Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
1
vote
1answer
292 views
Web application software architecture: basic security
I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer.
Let's say I have three components of a ...
15
votes
3answers
635 views
Is it a vulnerability to display exception messages in an error page?
Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display ...
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
8
votes
4answers
483 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
7
votes
2answers
585 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
4
votes
2answers
294 views
Canonicalization & Output Encoding
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
If any potentially hazardous characters (<>"'%()&+\\'\") ...
4
votes
2answers
224 views
OWASP Top 10? How about OWASP Top 1000?
Many people are aware of the "OWASP Top 10". I'm wondering if OWASP (or any similar authority) has gone above and beyond just the top 10 most commons attacks and made a larger list (e.g. the "OWASP ...
4
votes
1answer
1k views
Are there any tools for automated penetration testing of Silverlight applications?
I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps.
Specifically, I'm looking for a tool that can cope with ...
4
votes
1answer
353 views
How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?
It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing?
Some examples I'm thinking of ...
4
votes
2answers
393 views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
3
votes
2answers
273 views
Added security risks that come with 3-tier software architecture
Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project?
I got asked this today, and my gut reaction was "I don't see why there would be." ...
3
votes
2answers
320 views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
3
votes
2answers
164 views
Security while connecting to a mysql databse using pdo
I looked at this question: What is the right way of storing database connection strings from the security point of view?
and I'm wondering specifically for connecting to a mysql databse with PDO, how ...
2
votes
2answers
163 views
Is WCF or Java Metro security configuration in-scope for your security department; should it be?
Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet.
Given the port sharing abilities of IIS, or even that a web ...
1
vote
2answers
1k views
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match.
That seems to be somewhat of a risk, as the ...
0
votes
3answers
138 views
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.
What business/organisation(s) would have:
Sufficient technical skill ...
