Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
23
votes
4answers
2k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
-5
votes
1answer
42 views
History of Buffer Overflow attacks and it's countermeasures? [closed]
I want to know the chronology of BoF attacks and it's countermeasures.
We know it's started about 1972, here's a hypothetical of it:
Buffer Overflow Simple (attack)
ASLR (Contermeasure)
ret2reg ...
10
votes
2answers
414 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
0
votes
2answers
55 views
Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?
As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains.
In other ...
0
votes
0answers
28 views
Stack smashing protection, reordering variables
so few days ago I started reading a paper about bypassing SSP/ProPolice and after I read it all I tryed that bypasses but they didn't work. The code I used is this:
int f (char ** argv){
int ...
3
votes
1answer
72 views
Secure information exchange between web applications using browser redirection
We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
6
votes
2answers
132 views
Should I put a potentially insecure program online?
OK: a forward. I am not a security expert. I am one of four kids at a high school working on a project. I don't have any experience with real-life situations where security is a concern.
I have a ...
123
votes
11answers
15k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
4
votes
1answer
61 views
Is it worth following OWASP AppSensor for an open source web application?
I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application.
I think there is some value in using AppSensor to ...
15
votes
2answers
1k views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
0
votes
1answer
206 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
4
votes
2answers
92 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
2
votes
1answer
139 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
4
votes
3answers
234 views
Is writing shellcode still a valid skill to have/learn?
Following up from this question: Should I bother teaching buffer overflows any more?
I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
1
vote
1answer
115 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
1
vote
2answers
475 views
Strange Event Log Entry - Windows Server 2008
Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: ...
7
votes
3answers
423 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
3
votes
2answers
105 views
Security Scanning for Desktop Applications
Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
4
votes
2answers
148 views
Secure yet reversible encryption for local data store
I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
11
votes
3answers
748 views
What is the difference between Exploit and Payload?
In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
3
votes
2answers
93 views
User privileges for unsanatized code
We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
2
votes
2answers
116 views
Security Practices by Employees in a Corporate Environment
Consider the following situation :
1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website).
2. He sends a PDF document containing the requirement ...
0
votes
1answer
68 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
2
votes
3answers
72 views
Prevent request forgery attack
I don't know if I used the term correctly but basically this is the scenario:
I am working at an application witch on every computer install must make a request to a server notifying the server that ...
8
votes
3answers
192 views
Protecting against cross-subdomain cookie attacks
I have been reading about cross-subdomain cookie attacks here.
A quick overview of how it works (from Wikipedia):
A web site www.example.com hands out subdomains to untrusted third parties
One such ...
0
votes
3answers
149 views
get vs post which is more secure? [duplicate]
i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
3
votes
2answers
70 views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
2
votes
2answers
3k views
How to use OAuth with Active Directory
I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
3
votes
2answers
418 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
15
votes
4answers
3k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
1
vote
2answers
583 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
6
votes
3answers
334 views
What is the next step of this file upload attack?
Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
7
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
10
votes
4answers
362 views
How should I secure a contact form that appears on every page of a website?
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
8
votes
4answers
726 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
4
votes
3answers
238 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
10
votes
3answers
297 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
2
votes
4answers
275 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
52
votes
10answers
3k views
Does disabling right click have any impact on security?
On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
4
votes
1answer
153 views
What are possible consequences for applications that depends on Safe Mode for security?
PHP finally removed safe_mode feature:
Safe Mode
Warning
This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP
5.4.0.
The PHP safe mode is an attempt to solve the ...
1
vote
1answer
254 views
iOS auth/auth with a REST Webservice
we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
1answer
82 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
1
vote
1answer
44 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
4
votes
2answers
201 views
FrameBusting script
It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
7
votes
5answers
397 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
13
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
6
votes
4answers
229 views
Does using GUIDs for IDs make IDs unpredictable?
Say I have a website that stores credit card information and on that site I have a page where users can edit/delete their credit card information.
For the sake of the example lets say the HTML looks ...
43
votes
6answers
4k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
5
votes
3answers
270 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
