Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

0
votes
3answers
563 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
2
votes
2answers
236 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
1
vote
1answer
322 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
2
votes
1answer
353 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
1
vote
2answers
166 views

Signed URL's as a security measure

Would implementing signed URL's be an effective security measure to prevent URL tampering and poisoning on public facing resources accessed via a GET request. e.g. ...
1
vote
3answers
1k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
3
votes
1answer
552 views

How can I check the iframe on my website is secure or not?

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?
-2
votes
1answer
839 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
0
votes
1answer
646 views

Comprehensive & current book on native application exploit research & development [closed]

Is there a 'must read', comprenhensive book on native application exploit development? Covering the process of finding vulnerabilities (fuzzing, reverse engineering, code analysis, etc...) & ...
1
vote
1answer
679 views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
2
votes
3answers
3k views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
2
votes
2answers
177 views

What fraction of software bugs are vulnerabilities?

What fraction of software bugs are security vulnerabilities? Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact. Is ...
0
votes
2answers
332 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
2
votes
1answer
96 views

Stack smashing protection, reordering variables

So few days ago I started reading a paper about bypassing SSP/ProPolice and after I read it all I tried the bypasses but they didn't work. This is the code I used: int f (char ** argv){ ...
3
votes
1answer
264 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
6
votes
2answers
138 views

Should I put a potentially insecure program online?

OK: a forward. I am not a security expert. I am one of four kids at a high school working on a project. I don't have any experience with real-life situations where security is a concern. I have a ...
4
votes
2answers
201 views

Is it worth following OWASP AppSensor for an open source web application?

I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application. I think there is some value in using AppSensor to ...
4
votes
2answers
747 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
3answers
732 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
25
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
8
votes
3answers
696 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
4
votes
2answers
485 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
4
votes
2answers
948 views

Secure yet reversible encryption for local data store

I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
2
votes
1answer
482 views

How to hide victim pop-up in clickjacking?

I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
16
votes
3answers
5k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
1
vote
1answer
397 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
3
votes
2answers
113 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
2
votes
2answers
151 views

Security Practices by Employees in a Corporate Environment

Consider the following situation : 1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website). 2. He sends a PDF document containing the requirement ...
2
votes
3answers
92 views

Prevent request forgery attack

I don't know if I used the term correctly but basically this is the scenario: I am working at an application witch on every computer install must make a request to a server notifying the server that ...
12
votes
3answers
3k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
0
votes
3answers
4k views

get vs post which is more secure? [duplicate]

i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
3
votes
2answers
148 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
4
votes
2answers
5k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
9
votes
3answers
2k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
5
votes
3answers
3k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
16
votes
4answers
5k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
2
votes
4answers
578 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
4
votes
1answer
220 views

What are possible consequences for applications that depends on Safe Mode for security?

PHP finally removed safe_mode feature: Safe Mode Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. The PHP safe mode is an attempt to solve the ...
1
vote
1answer
991 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
13
votes
6answers
39k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
0
votes
1answer
241 views

All I see is RPC, how do I proceed?

I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise. The machine was only running ...
1
vote
1answer
83 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
60
votes
10answers
5k views

Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
6
votes
4answers
352 views

Does using GUIDs for IDs make IDs unpredictable?

Say I have a website that stores credit card information and on that site I have a page where users can edit/delete their credit card information. For the sake of the example lets say the HTML looks ...
3
votes
1answer
191 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
11
votes
1answer
5k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
8
votes
2answers
1k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
1
vote
1answer
156 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
1
vote
1answer
219 views

Breaking out of the virtualization layer

Problem So I set up a virtual backtrack machine using VMware Workstation - I'm trying to launch an attack against the host OS (Ubuntu Linux) from the virtualized host (backtrack), but I do not ...
2
votes
1answer
1k views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...