Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms

1
vote
2answers
312 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
4
votes
6answers
611 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
5
votes
2answers
559 views

Established Security Design Patterns?

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
4
votes
2answers
941 views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
6
votes
2answers
459 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
3
votes
2answers
10k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
13
votes
5answers
1k views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
10
votes
7answers
5k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
17
votes
4answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
3
votes
2answers
183 views

Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?

I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
8
votes
3answers
9k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
2
votes
2answers
877 views

Why should crossdomain.xml be present if user-uploaded files exist?

In his book Michal Zalewski says: To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
27
votes
7answers
2k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
2
votes
2answers
342 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
3
votes
3answers
221 views

What security standards should be implemented in a simple web application

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
5
votes
3answers
339 views

What fraction of web sites are vulnerable?

It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
2
votes
3answers
286 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
1
vote
3answers
172 views

Smartphone SSH clients with shared user

I am writing an application for smartphones to provide very limited SSH usage. The user cannot perform arbitrary actions when logged in. They can run a specific script(s) only. For various reasons ...
11
votes
2answers
953 views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
4
votes
0answers
11k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
4
votes
2answers
151 views

Changing windows client form values at runtime

I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
1
vote
1answer
380 views

Web application software architecture: basic security

I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer. Let's say I have three components of a ...
5
votes
3answers
376 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
2
votes
2answers
157 views

For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?

Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
22
votes
1answer
2k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
3
votes
5answers
4k views

Reverse engineering (decompiling) an .exe file in OSX

I am a complete newby in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
12
votes
4answers
321 views

Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?

Background We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
4
votes
2answers
567 views

Could the bcrypt-ruby binding be vulnerable?

While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
4
votes
2answers
2k views

How to store IV and key temporarily but securely

I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
7
votes
2answers
249 views

Should I store my intellectual property / code online?

As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much ...
6
votes
2answers
197 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
4
votes
2answers
1k views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
2
votes
1answer
353 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
0
votes
1answer
61 views

Is there a grading standard for security that I can apply to my MVC3 web site?

I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list ...
7
votes
4answers
1k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
5
votes
2answers
1k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
4
votes
4answers
5k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
5
votes
1answer
482 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
8
votes
2answers
651 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
5
votes
2answers
2k views

Benefits to BlackArch over Kali

Besides BlackArch having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of BlackArch over Kali? Are the tools broadly the same, or does one have better ...
6
votes
4answers
3k views

How to harden an iPhone/Android app so its tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
1
vote
5answers
199 views

How to replace a constant identifier, for a resource on a network, with a variable one?

I guess the example can make it easier. Assume each Client on a network has an identifier(some alphanumeric sequence) which identifies it uniquely on the network. Each time the Client corresponds ...
0
votes
2answers
174 views

What is Greasemonkey / Userscripts and how does it relate to IT Security?

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of ...
1
vote
1answer
602 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
2
votes
1answer
225 views

Is 90 day expiration for unique URL too long?

A web application I've been developing has a new use case that has me searching for something easier than username/password authentication. Current users don't sign up for the service themselves ...
3
votes
4answers
1k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
2
votes
1answer
78 views

Are user-provided translation strings an attack vector

Twitter and various other web companies allow users to help translate the user interface into their language. Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on ...
1
vote
2answers
690 views

anti-CSRF tokens vs Referer and POST testing

I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that ...
0
votes
1answer
343 views

Business systems development (.NET, Java) vs IT Security Field, salary/future perspective

What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java? Which path should one ...