Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

7
votes
2answers
253 views

Should I store my intellectual property / code online?

As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much ...
7
votes
6answers
2k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
7
votes
2answers
101 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
7
votes
3answers
655 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
7
votes
4answers
6k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
7
votes
4answers
891 views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or ...
7
votes
4answers
288 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
7
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...
7
votes
1answer
5k views

Benefits to BlackArch over Kali

Besides BlackArch having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of BlackArch over Kali? Are the tools broadly the same, or does one have better ...
7
votes
1answer
323 views

how to configure edit-restricted mediawiki

I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user. I am planning to create a very restricted ...
7
votes
1answer
257 views

Should an app remove or encrypt locally stored user data after a user logs out?

I’ve been poking around in the Application Support folder of a popular app, trying to extract some chat logs. (By “popular”, I mean that most people reading this will have heard of it. I’m not sure if ...
7
votes
2answers
628 views

Established Security Design Patterns?

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
7
votes
2answers
2k views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
7
votes
2answers
413 views

I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested?

This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic. I mean what they request for, ...
6
votes
4answers
678 views

Is XSS dangerous in application without database?

I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker. Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
6
votes
6answers
2k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
6
votes
7answers
1k views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
8answers
718 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
6
votes
4answers
375 views

What is the solution to Schneier's Law?

Schneier's law (which should probably be called Babbage's Law). States that: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't ...
6
votes
3answers
534 views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
6
votes
3answers
331 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
6
votes
3answers
9k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...
6
votes
2answers
760 views

GET with additional parameters leads to “code injection” in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET ...
6
votes
4answers
4k views

How to harden an iPhone/Android app so its tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
6
votes
4answers
337 views

Does using GUIDs for IDs make IDs unpredictable?

Say I have a website that stores credit card information and on that site I have a page where users can edit/delete their credit card information. For the sake of the example lets say the HTML looks ...
6
votes
2answers
6k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
6
votes
3answers
1k views

Safe implementation of sharing encryption secrets (username, password) in the cloud

I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
6
votes
2answers
393 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
6
votes
3answers
181 views

What indicators did OWASP use to end up with OWASP Top 10?

I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ... Knowing that each of these ...
6
votes
2answers
225 views

Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
6
votes
1answer
700 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
6
votes
1answer
191 views

What responsibility do I have in continuing another developer's work?

My question is related to this one. I did not found anything googling around and that is why I am asking. This question I am the sole web developer for a firm, and I manage everything, from ...
6
votes
3answers
415 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
6
votes
2answers
839 views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
6
votes
1answer
1k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
6
votes
3answers
663 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
6
votes
2answers
1k views

What are the security risks of the Service Bus, and how do you mitigate them?

The Service Bus is software that can be installed on Windows or rented on Azure and allows someone to relay SOAP/WCF information over the internet in the form of a XML over HTTPS payload. One risk ...
6
votes
2answers
329 views

How often is ASLR randomness refreshed, in Linux?

Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
6
votes
3answers
188 views

How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store? You might for example have an open source ...
6
votes
3answers
485 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
6
votes
1answer
149 views

Secure forgot password page: Is a server-stateless implementation viable?

This is yet another "How is a forgot my password page done right" question. However, it explicitly addresses two implementation options that I have come across recently. The common approaches [1,2] ...
6
votes
2answers
221 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
6
votes
1answer
157 views

Creating a Private Key using Human Intervention

In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
6
votes
1answer
57 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
6
votes
2answers
138 views

Should I put a potentially insecure program online?

OK: a forward. I am not a security expert. I am one of four kids at a high school working on a project. I don't have any experience with real-life situations where security is a concern. I have a ...
6
votes
4answers
1k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
5
votes
6answers
800 views

How do I secure my login page?

The login page is the starting point to any web site and the most important thing to authenticate the user. When I begin to build any web application, I take a lot of time to think about how to ...
5
votes
4answers
1k views

Using password hash as session ID?

For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess. I have an idea I am ...