Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

9
votes
4answers
590 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
0
votes
0answers
2 views

Prevent children of process protected by seccomp from having same seccomp protections? [migrated]

I'm writing an application which is protected by seccomp. This application uses fork() and then execvp() to run certain programs. It seems as though any child process of my program will be constrained ...
69
votes
4answers
14k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
90
votes
9answers
51k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
28
votes
4answers
12k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
313
votes
11answers
58k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
10
votes
4answers
776 views

Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so I'd be interested to hear any criteria people might use when assessing Security static analysis tools. ...
-2
votes
0answers
33 views

Technical Pentest Name on Intrusion via Enumeration? [closed]

Okay, first off, it so happens that I was given a penetration test which were rejected by my lower vulnerability researchers (basically coming from the bug bounty family). As a part of my job role, I ...
7
votes
5answers
964 views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
7
votes
3answers
636 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
6
votes
2answers
6k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
2
votes
1answer
53 views

Intel SGX and MSRs - what do developers need to know?

Intel SGX is an intriguing new technology that will ship as part of upcoming Intel processors. It is designed to enable running software in a secure enclave. Code running in the enclave will be ...
0
votes
3answers
96 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
2
votes
1answer
79 views

help developer choose correct path to go down for security certifications [duplicate]

Sorry if this is a duplicate however I felt it was a little more unique than the answers I found. Basically I am a software developer and I have moved recently into an architecture role. Throughout my ...
6
votes
1answer
107 views

Secure forgot password page: Is a server-stateless implementation viable?

This is yet another "How is a forgot my password page done right" question. However, it explicitly addresses two implementation options that I have come across recently. The common approaches [1,2] ...
52
votes
7answers
15k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
4
votes
2answers
656 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
1
vote
2answers
72 views

Best way to securely store passwords for local use?

I am writing a Java application who needs three username/password pairs. I would like to add a "remember me" feature, implying I would have to store passwords on the user's computer. Knowing this ...
6
votes
3answers
406 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
5
votes
2answers
1k views

How do I know my tools aren't compromised? [closed]

After reading different articles, most notably/concerningly: If the NSA has been hacking everything, how has nobody seen them coming? Ken Thompson's Hack (more the concept than specifics) I am ...
-1
votes
3answers
191 views

How to check for sql injection attack? [closed]

We do our final year project related to sql injection. For implementing sql injection attack which IDE or tool we used? bcoz netbeans and other type of IDE are more secured?
10
votes
3answers
2k views

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers Could somebody please ...
6
votes
1answer
48 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
17
votes
5answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
17
votes
3answers
2k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
2
votes
0answers
56 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
9
votes
3answers
795 views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
0
votes
2answers
51 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
1
vote
1answer
26 views

How can I defend against Heroku (or any PAAS) ID theft?

How can I defend against Heroku (or any PAAS) ID theft? Is it correct to assume that if someone obtained my Heroku credentials that they would have access to any data in my app, regardless of any ...
20
votes
5answers
4k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
1
vote
1answer
44 views

Other than synchronizer token, is there any way of protection against CSRF using http headers?

Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?
1
vote
3answers
4k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
1
vote
3answers
171 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
2
votes
2answers
75 views

Can we verify that an app store ships the same code I have been shown?

When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security ...
0
votes
2answers
71 views

What is the difference between CERT C secure coding standard and other coding standards?

We are updating our C, C++ and C# coding standards to include security requirements. I know there are coding standards based on the following: PCI-DSS CWE Top 25 OWASP Top 10 NIST SAMATE What is ...
20
votes
5answers
12k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
12
votes
7answers
6k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
10
votes
3answers
2k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
13
votes
5answers
3k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
1
vote
0answers
25 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
2
votes
0answers
150 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
33
votes
5answers
18k views

Are there security issues with embedding an HTTPS iframe on an HTTP page?

I've seen websites placing HTTPS iframes on HTTP pages. Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the ...
-1
votes
2answers
102 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
2
votes
2answers
84 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
1
vote
1answer
63 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
6
votes
1answer
4k views

Benefits to BlackArch over Kali

Besides BlackArch having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of BlackArch over Kali? Are the tools broadly the same, or does one have better ...
-3
votes
1answer
61 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
3
votes
2answers
209 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
1
vote
3answers
107 views

Validating Credentials - Logic in Application vs Database

I am studying Web Application Security, A Beginner's Guide Paperback – November 3, 2011 by Bryan Sullivan (Author), Vincent Liu (Author) On pp 69, "Validating Credentials", they say you can ...
0
votes
2answers
144 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...