Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms

4
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications?

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
4
votes
1answer
483 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
3
votes
2answers
560 views

Added security risks that come with 3-tier software architecture

Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project? I got asked this today, and my gut reaction was "I don't see why there would be." ...
3
votes
2answers
295 views

Security while connecting to a mysql databse using pdo

I looked at this question: What is the right way of storing database connection strings from the security point of view? and I'm wondering specifically for connecting to a mysql databse with PDO, how ...
2
votes
2answers
799 views

Is Drupal's filter_xss enough for filtering HTML?

Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input? If not, what should be used instead when using Drupal 7? This questuion is a duplicate of Drupal's built-in ...
2
votes
2answers
202 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
1
vote
1answer
188 views

Breaking out of the virtualization layer

Problem So I set up a virtual backtrack machine using VMware Workstation - I'm trying to launch an attack against the host OS (Ubuntu Linux) from the virtualized host (backtrack), but I do not ...
0
votes
1answer
89 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
0
votes
1answer
101 views

Desktop API Security

I have a Desktop API written in C++. Within this API I call a REST API to register with my service (using typical email user validation). The REST API is protected with a ID and SECRET; the requests, ...
0
votes
3answers
145 views

What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective. What business/organisation(s) would have: Sufficient technical skill ...