Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms

4
votes
2answers
1k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
7
votes
4answers
2k views

Does default ModSecurity protect enough against XSS?

It's been a few years since I mucked around with modsecurity... Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
14
votes
4answers
1k views

Web Security Cheatsheet / ToDo list

Can anyone suggest a cheatsheet or ToDo list of web site and application security? A local small business owner prompted a question about web security, basically her company website just got XSS ...
5
votes
2answers
957 views

Generating one-time tokens from API-key?

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site. I intend to distribute secret API-keys to ...
12
votes
4answers
585 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
8
votes
3answers
1k views

Practical non-government uses of Biba, Bell-LaPadula, etc. models

For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
4
votes
2answers
162 views

What is the benefit of combining different web log files with different formats?

What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...
5
votes
3answers
430 views

Web server file sniffing

What is it called when a user tries several attempts to figure out the files and folder structure on a web server? For example, the attacker will run http://example.com/test.jpg to determine if ...
5
votes
3answers
384 views

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
0
votes
2answers
440 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
3
votes
2answers
449 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
4
votes
2answers
867 views

P3P HTTP Headers and Session ID's

Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?
5
votes
2answers
1k views

When should I not use CSRF protection for a form?

By default, I have CSRF protection for all my forms using a token. However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token. So I ...
14
votes
4answers
3k views

Is AJAX fundamentally insecure?

Possible Duplicate: How to do Ajax securely? At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
7
votes
4answers
2k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
13
votes
5answers
1k views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
9
votes
3answers
879 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
34
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
9
votes
3answers
918 views

How do I secure my SaaS startup?

I came across this question I like to offer my startup also for security advice. Objective: building a SaaS web application that allows businesses to quickly open up online stores akin to Yahoo! ...
18
votes
5answers
3k views

Where can I find a solid BURP tutorial?

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
0
votes
4answers
141 views

Safely changing text links to HTML anchors

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
3
votes
1answer
158 views

Which is more secure: develop a mobile app in its Native language or using cross-platform UI?

I am just wondering if there are benefits from a security perspective to develop a mobile App either as native app or as a cross-platform UI app, in particular Rhodes? I need to develop an application ...
2
votes
2answers
550 views

What CSS is considered Safe or Unsafe within a multi tenant website?

I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says Cascading style sheets Behaviors are one feature that the Surveys site will not support. What CSS ...
5
votes
3answers
7k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...
32
votes
2answers
8k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
3
votes
2answers
518 views

BlackBerry client authenticating to Java Web Service

I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
13
votes
2answers
3k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
-1
votes
4answers
4k views

SQL injection for a username/password form?

This is how user validation happens on my site: if(!empty($_POST['username']) && !empty($_POST['password'])) { $query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
18
votes
4answers
11k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
1
vote
2answers
2k views

Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?

I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
3
votes
3answers
1k views

Altering a $_SESSION variable in PHP via XSS?

Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script? One of our scripts uses a $_SESSION variable and I'm not sure if ...
1
vote
1answer
191 views

Replicating javascript actions from different website (XSS?)

I've got html / javascript code on my site like this: <a ...
0
votes
2answers
361 views

What browser plugins (ActiveX, or those for Chrome/Firefox/Safari etc) pose the most risk for your company?

I'm looking for a list of risky browser plugins that we should prevent their use on the desktop. It's probably safe to assume that old versions of Flash are on the list, but what versions? What ...
4
votes
1answer
265 views

What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?

The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
4
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...
3
votes
2answers
327 views

Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?

Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
6
votes
2answers
221 views

Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
65
votes
8answers
7k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I ...
7
votes
4answers
804 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
5
votes
1answer
506 views

Good Security tool for PHP- Suhosin vs Spike vs PHPIDS

Do I have to check/test my code beforehand, or do these tools inform me when an attempt is being made in real time? Secondly, which one should I go for -- Suhosin or Spike or PHPIDS or a combo? What ...
4
votes
1answer
90 views

Does the compiler feature of Closures decrease member variable security?

Based on this discussion, closures in C# promote private variables to public variables at compile time. Suppose a closure was implemented on a Username or Password string. Would there be any ...
10
votes
3answers
2k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities?

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
4
votes
1answer
191 views

When does one need to be concerned with leaking timing information in .NET?

According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison. When working with .NET crypto classes, when should ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
0
votes
1answer
153 views

Does using many XML parsers (XDocument, XMLDocument) from the public Internet increase attack surface area?

I am coding an anonymous WCF service that allows others to post XML into it. Does using different kinds of XML parsers XDocument, XMLDocument, or even 3rd party parsers increase the attack surface ...
8
votes
3answers
5k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
4
votes
1answer
684 views

Why does Bouncy Castle have a separate download for the IDEA algorithm?

I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not. http://www.bouncycastle.org/csharp/ Why ...
3
votes
1answer
3k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
6
votes
3answers
957 views

Safe implementation of sharing encryption secrets (username, password) in the cloud

I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
6
votes
8answers
671 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...