Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
1
vote
1answer
320 views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
2
votes
1answer
195 views
Is 90 day expiration for unique URL too long?
A web application I've been developing has a new use case that has me searching for something easier than username/password authentication.
Current users don't sign up for the service themselves ...
3
votes
4answers
647 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
1
vote
1answer
70 views
Are user-provided translation strings an attack vector
Twitter and various other web companies allow users to help translate the user interface into their language.
Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on ...
1
vote
2answers
436 views
anti-CSRF tokens vs Referer and POST testing
I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that ...
0
votes
1answer
239 views
Business systems development (.NET, Java) vs IT Security Field, salary/future perspective
What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java?
Which path should one ...
1
vote
1answer
364 views
Windows Session Recording Software
I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying).
I've heard about a software which can record a video of any ...
6
votes
3answers
636 views
Are there any established mobile security frameworks or secure coding guidelines available?
I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5.
If there are no ...
2
votes
2answers
161 views
Security while connecting to a mysql databse using pdo
I looked at this question: What is the right way of storing database connection strings from the security point of view?
and I'm wondering specifically for connecting to a mysql databse with PDO, how ...
1
vote
2answers
147 views
hardware required for wifi security system
i am planning to implement one WIFI security system , in which one can lock or unlock door remotely.
As i have serched over internet and i came across
lockitron and schlage
Now what i want to know ...
9
votes
2answers
179 views
Should I prevent user from operating with site during some first seconds?
Imagine the following scenario: User is at attacker.com and plays a game there. Just before he clicks at some point he is rerouted to victim.com using browser's history. User thought that he clicked ...
10
votes
1answer
1k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
5
votes
2answers
571 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
5
votes
3answers
206 views
Should user input be validated for it's length?
Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other?
I think it depends on programming language of ...
4
votes
3answers
151 views
How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?
Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source ...
5
votes
3answers
1k views
Where can I find exploit code?
I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are:
2010-1917,
...
1
vote
2answers
460 views
Strange Event Log Entry - Windows Server 2008
Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: ...
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
5
votes
1answer
115 views
Is it safe to allow untrusted field names in JSON?
When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
2
votes
1answer
65 views
Is there a drawback for local log in compared to server log in?
For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
6
votes
1answer
99 views
Creating a Private Key using Human Intervention
In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
10
votes
3answers
294 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
15
votes
3answers
909 views
Why aren't applications sandboxed in Windows?
Sandboxing seem to be a way to restrict what an application can do. Today, I don't have much control of what my applications do with my computer. It feels more secure to use JavaScript based web ...
7
votes
2answers
291 views
How can I restrict what an application can do with my computer?
Often when I install applications on my computer, I realize that I need to trust the application because it can do what ever it want with my computer, e.g. accessing files, listen to my keyboard, ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
6
votes
7answers
531 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
8
votes
1answer
153 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
3
votes
0answers
257 views
When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]
I am trying to secure my application which is built using JSF2.0.
I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
13
votes
4answers
11k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
1
vote
1answer
274 views
Is there any way to use Nuget securely?
Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"
The problem I have is that anyone can pretend to be ...
15
votes
2answers
343 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
8
votes
9answers
340 views
What is the proper way to view the sourcecode of a website?
I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is ...
7
votes
3answers
489 views
Security fields: AppSec vs. InfoSec vs. NetSec, etc
When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
0
votes
3answers
138 views
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.
What business/organisation(s) would have:
Sufficient technical skill ...
7
votes
3answers
968 views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
4
votes
1answer
84 views
Reading about security by design?
Security folks often encourage people to build security in from the start, and architect systems that are secure by design. What are some readings you would recommend for someone who wants to learn ...
0
votes
1answer
295 views
What are some good resources for learning how to hack my website? [closed]
Note: This is for my personal use. I'm not going to hack someone else's website.
I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good ...
3
votes
2answers
76 views
Appsec Standards Organizations?
I'm a Java EE developer and I was wondering if anybody has had experience with the OWASP Project and could weigh-in as to how it measures up as a security standards organization. They have a huge ...
6
votes
4answers
350 views
Criteria for Evaluating Static Analysis Tools
As with any tools purchase part of the outcome is in how good the evaluation criteria are, so I'd be interested to hear any criteria people might use when assessing Security static analysis tools.
...
7
votes
3answers
998 views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
3
votes
1answer
379 views
Securing sensitive data in a DB,is using H2 worth it?
I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now ofc besides the usual pwd hashing + salt +.... I was thinking ...
4
votes
2answers
488 views
Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?
In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb):
1 or sleep(TIME)#
" or sleep(TIME)#
' or ...
11
votes
3answers
2k views
How should web app developers defend against JSON hijacking?
What is the best defense against JSON hijacking?
Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested:
If the ...
5
votes
2answers
325 views
Length of CSRF Token
Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
5
votes
3answers
200 views
How safe are copies of Firefox that are on various Mozilla mirror sites?
If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added?
I don't see any mechanism for ...
10
votes
4answers
242 views
Can apps be trusted when requesting your credentials?
I recently bought a newsreader app for my tablet that connects to Google Reader. To do so, it required my Google account password. Isn't this effectively the same as handling the password to the ...
8
votes
5answers
280 views
In what ways do some banks inadequately advise their customers on online security?
I'm looking for specific examples of things such as:
Misleading, but common advice
Advice which has backfired
Advice which is just, quite simply, incorrect
which have been circulated time and time ...
5
votes
2answers
227 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
12
votes
2answers
699 views
The Creation of Secure Software Development Environments
[Edit] I did complete an analysis and framework of concepts
that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct ...
