Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

2
votes
1answer
39 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
2
votes
1answer
199 views

Examples of “Runtime application self-protection” (RASP) in action?

I'm having a hard time figuring out what "Runtime Application Self-Protection" (RASP) really is, though I see it mentioned in the press. The best description I've seen of the possible benefits, along ...
0
votes
1answer
190 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
0
votes
1answer
159 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
3
votes
0answers
293 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
2
votes
0answers
71 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
1
vote
0answers
42 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
1
vote
0answers
21 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
1
vote
0answers
115 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
40 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
24 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
28 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
1
vote
0answers
67 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
0answers
58 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
39 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
0
votes
0answers
42 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
241 views

How can the .rsrc section of a PE used for evil?

I was doing some work with a bootable iso and ClamXav notified me that if found a potential security threat in one of the drivers, nvstor32.sys, located in the iso. I was really curious, so I googled ...
0
votes
0answers
83 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...