Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms

4
votes
2answers
489 views

Secure yet reversible encryption for local data store

I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
2
votes
1answer
304 views

How to hide victim pop-up in clickjacking?

I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
14
votes
3answers
3k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
1
vote
1answer
234 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
3
votes
2answers
105 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
2
votes
2answers
130 views

Security Practices by Employees in a Corporate Environment

Consider the following situation : 1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website). 2. He sends a PDF document containing the requirement ...
2
votes
3answers
86 views

Prevent request forgery attack

I don't know if I used the term correctly but basically this is the scenario: I am working at an application witch on every computer install must make a request to a server notifying the server that ...
11
votes
3answers
2k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
0
votes
3answers
2k views

get vs post which is more secure? [duplicate]

i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
3
votes
2answers
122 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
3
votes
2answers
3k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
8
votes
3answers
1k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
12
votes
4answers
2k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
2
votes
4answers
372 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
4
votes
1answer
185 views

What are possible consequences for applications that depends on Safe Mode for security?

PHP finally removed safe_mode feature: Safe Mode Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. The PHP safe mode is an attempt to solve the ...
1
vote
1answer
740 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
1answer
139 views

All I see is RPC, how do I proceed?

I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise. The machine was only running ...
1
vote
1answer
78 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
56
votes
10answers
5k views

Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
6
votes
4answers
288 views

Does using GUIDs for IDs make IDs unpredictable?

Say I have a website that stores credit card information and on that site I have a page where users can edit/delete their credit card information. For the sake of the example lets say the HTML looks ...
3
votes
1answer
184 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
11
votes
1answer
3k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
7
votes
2answers
935 views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
1
vote
1answer
146 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
1
vote
1answer
170 views

Breaking out of the virtualization layer

Problem So I set up a virtual backtrack machine using VMware Workstation - I'm trying to launch an attack against the host OS (Ubuntu Linux) from the virtualized host (backtrack), but I do not ...
2
votes
1answer
726 views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
4
votes
2answers
153 views

DPAPI and malware

I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
0
votes
1answer
96 views

Desktop API Security

I have a Desktop API written in C++. Within this API I call a REST API to register with my service (using typical email user validation). The REST API is protected with a ID and SECRET; the requests, ...
19
votes
7answers
998 views

How Involved Should a Developer Be in Designing a Security Policy?

I've been developing software for well over 20 years. During that time I've worked in Fortune 100 companies that had very specific security requirements developed by dedicated security professionals ...
1
vote
2answers
236 views

Do XBAP applications have the same vulnerabilities as Java Web Apps?

In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications. XBAP applications are similar to Silverlight but it offers more options to ...
0
votes
1answer
211 views

Generating Web Application Security Profile

Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. ...
6
votes
2answers
291 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
-3
votes
1answer
143 views

What are the main reasons to leave an IT Security position? [closed]

There are many questions here on how to enter the field of IT Security. What are some reasons why people have left or are trying to get out of an IT Security position? This may be useful to know in ...
5
votes
6answers
2k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
-2
votes
1answer
913 views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
6
votes
1answer
186 views

What responsibility do I have in continuing another developer's work?

My question is related to this one. I did not found anything googling around and that is why I am asking. This question I am the sole web developer for a firm, and I manage everything, from ...
0
votes
3answers
128 views

Does including decorative HTTP headers into server reply pose extra security risk?

Suppose I reconfigure my HTTP server to add the following HTTP header into every reply: X-Hello: Hello! or some other presumably funny text. Can this have any negative effect on the server ...
9
votes
3answers
391 views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
2
votes
2answers
252 views

Checklist for securing MacOSX

Is there a checklist for securing MacOSX machines?
1
vote
2answers
206 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
1
vote
1answer
86 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
2
votes
4answers
1k views

Is it necessary to scan users' file uploads by antivirus?

Web application allows users to upload files. Is it necessary to scan those files by antivirus? I'd want to hear answer in two scenarios: Type of file isn't checked when uploading. They are stored ...
7
votes
4answers
242 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
0
votes
2answers
2k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
14
votes
4answers
595 views

Application security training for developers

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
5
votes
2answers
3k views

Best way to securely set a session cookie on another domain

We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...
18
votes
2answers
10k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
-1
votes
1answer
144 views

Mac app purchase validation

How do I sell a mac app off of my website without somebody being able to copy-and-paste the app to some friends after he buys it, etc.. I understand that you can use receipt validation when selling ...
3
votes
2answers
477 views

Added security risks that come with 3-tier software architecture

Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project? I got asked this today, and my gut reaction was "I don't see why there would be." ...