prevention of an attack vector (e.g. XSS, HPP, CSRF)
3
votes
2answers
196 views
FrameBusting script
It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
51
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
16
votes
7answers
604 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
16
votes
8answers
830 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
5
votes
2answers
400 views
How does OWASP ESAPI protect against direct object reference vulnerabilities?
What other good solutions are there?
From the Area51 proposal
43
votes
2answers
5k views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
5
votes
4answers
1k views
How effective are reverse proxies as a web application security measure?
How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they?
For example are they more effective in preventing ...
19
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
9
votes
3answers
549 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
7
votes
3answers
264 views
What are the pros/cons of using a threat detection system?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects ...
16
votes
5answers
918 views
Designing in zero day attack mitigations
What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
7
votes
7answers
502 views
IP address black list
My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
19
votes
6answers
308 views
User input data, is filtering enough or should it be parsed?
In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...
13
votes
3answers
677 views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
