Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
0
votes
1answer
98 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
4
votes
2answers
71 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
2
votes
1answer
132 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
-3
votes
0answers
23 views
How to use FCKeditor safely ? [duplicate]
How can I implement FCKeditor in my website keeping it secure from Cross Site Scripting. I am using ASP.NET and C#.
4
votes
3answers
215 views
Is writing shellcode still a valid skill to have/learn?
Following up from this question: Should I bother teaching buffer overflows any more?
I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
1
vote
1answer
114 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
1
vote
2answers
462 views
Strange Event Log Entry - Windows Server 2008
Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: ...
6
votes
3answers
382 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
3
votes
2answers
100 views
Security Scanning for Desktop Applications
Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
-5
votes
0answers
86 views
IT Security professional or software developer.. which is a better career option? [closed]
I am a fresher out of college. I have completed my masters in computer applications. Currently i am working as a java developer in an IT services firm ( a pretty big one).
I am good at development ...
4
votes
2answers
129 views
Secure yet reversible encryption for local data store
I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
11
votes
3answers
696 views
What is the difference between Exploit and Payload?
In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
3
votes
2answers
91 views
User privileges for unsanatized code
We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
2
votes
2answers
115 views
Security Practices by Employees in a Corporate Environment
Consider the following situation :
1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website).
2. He sends a PDF document containing the requirement ...
0
votes
1answer
59 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
2
votes
3answers
70 views
Prevent request forgery attack
I don't know if I used the term correctly but basically this is the scenario:
I am working at an application witch on every computer install must make a request to a server notifying the server that ...
7
votes
3answers
137 views
Protecting against cross-subdomain cookie attacks
I have been reading about cross-subdomain cookie attacks here.
A quick overview of how it works (from Wikipedia):
A web site www.example.com hands out subdomains to untrusted third parties
One such ...
0
votes
3answers
135 views
get vs post which is more secure? [duplicate]
i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
3
votes
2answers
67 views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
2
votes
2answers
3k views
How to use OAuth with Active Directory
I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
3
votes
2answers
407 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
15
votes
4answers
3k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
1
vote
2answers
468 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
6
votes
3answers
307 views
What is the next step of this file upload attack?
Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
10
votes
4answers
357 views
How should I secure a contact form that appears on every page of a website?
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
7
votes
4answers
678 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
4
votes
3answers
195 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
10
votes
3answers
296 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
2
votes
4answers
264 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
52
votes
10answers
3k views
Does disabling right click have any impact on security?
On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
4
votes
1answer
151 views
What are possible consequences for applications that depends on Safe Mode for security?
PHP finally removed safe_mode feature:
Safe Mode
Warning
This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP
5.4.0.
The PHP safe mode is an attempt to solve the ...
1
vote
1answer
211 views
iOS auth/auth with a REST Webservice
we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
1answer
79 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
1
vote
1answer
44 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
3
votes
2answers
196 views
FrameBusting script
It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
7
votes
5answers
392 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
6
votes
4answers
228 views
Does using GUIDs for IDs make IDs unpredictable?
Say I have a website that stores credit card information and on that site I have a page where users can edit/delete their credit card information.
For the sake of the example lets say the HTML looks ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
5
votes
3answers
267 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
0
votes
1answer
82 views
A list of very specific infosec topics with very fine detail [closed]
CISSP CBK seems relatively rudimentary and extremely broad.
Does anyone know a good resource that lists (a nice, long list) topics in information security with a very, very fine granularity?
This:
- ...
9
votes
1answer
445 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
5
votes
2answers
575 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
4
votes
3answers
151 views
How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?
Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source ...
11
votes
5answers
991 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
7
votes
2answers
248 views
What unique risks does MVC model binding bring to a website? What additional vigilance is needed?
From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
