Application security - Specific to securing an application rather than the connection, infrastructure, browser etc
114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
15
votes
1answer
848 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
3
votes
4answers
447 views
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Let's say I develop an application that,
Allows any user to upload a file of only white listed mime content type and extensions (word and pdf).
Serves those files with the allowed extension and ...
7
votes
3answers
974 views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
48
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
9
votes
3answers
548 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
19
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
10
votes
3answers
1k views
What are the security risks of letting the users upload content to my site?
As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
5
votes
2answers
494 views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
35
votes
4answers
5k views
Recommended # of iterations when using PKBDF2-SHA256?
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
18
votes
14answers
1k views
How can you become a competent web application security expert without breaking the law?
This question was asked here on Programmers Exchange, but it was suggested I ask here as well since most of the experts would likely hang out on IT Security exchange instead.
I find this to be ...
15
votes
3answers
2k views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
34
votes
7answers
9k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
17
votes
3answers
3k views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
9
votes
3answers
891 views
Can anyone suggest good open source tools for scanning source code for vulnerabilities?
I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
8
votes
5answers
533 views
Protect application from being modified
I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
6
votes
1answer
2k views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
7
votes
4answers
1k views
Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
21
votes
5answers
2k views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
25
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
4
votes
2answers
378 views
Beginners materials for web security [duplicate]
Possible Duplicate:
Resources to learn about security
What materials can I study to learn web development security. I'm a web developer, I use ASP.NET, Java, PHP, and JavaScript. I want to ...
17
votes
8answers
743 views
How to protect against brute forcing
How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
11
votes
4answers
448 views
what to do after suspected intrusion on hobby webserver
I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
15
votes
2answers
2k views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
7
votes
5answers
840 views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
6
votes
5answers
1k views
Why do people say that PHP is inherently insecure?
I've heard it said that PHP is inherently insecure. Is this true? Why?
6
votes
2answers
209 views
What is considered the simplest (or lightest) secure development lifecycle?
Microsoft has there simplified SDL:
"The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development."
"The process outlined in this paper ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
2
votes
3answers
3k views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
12
votes
2answers
1k views
How to do Ajax securely?
This question is inspired by this security question http://security.stackexchange.com/questions/1707
What are the threats in using Ajax? (Please note I am talking about security threats, not ...
13
votes
4answers
749 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
10
votes
2answers
471 views
Storing sensitive information securely
I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
15
votes
7answers
693 views
If I include a Forgot Password service, then what's the point of using a password?
I've implemented a Forgot Password service in the following way:
User goes to login page, clicks on "Forgot password?"
User is presented with a form that asks for their email address.
Email is sent ...
15
votes
2answers
352 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
15
votes
2answers
2k views
When the use of a AntiForgeryToken is not required /needed?
I'm running a rather large site with thousands of visits every day, and a rather large userbase.
Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
13
votes
4answers
11k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
13
votes
4answers
790 views
Is AJAX fundamentally insecure?
Possible Duplicate:
How to do Ajax securely?
At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
12
votes
3answers
579 views
Programmer to Security Professional
I am a software developer (mostly .NET and Python about 2-3 years exp.) looking to break into the Computer Security field. I have a GWAPT cert and will have both GSSP-NET and Network+ certs by the end ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
7
votes
2answers
216 views
I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested?
This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic.
I mean what they request for, ...
9
votes
5answers
1k views
Storing private asymmetric key in application binary?
I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
7
votes
3answers
176 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
