2
votes
1answer
127 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
4
votes
2answers
567 views

Could the bcrypt-ruby binding be vulnerable?

While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
5
votes
2answers
332 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
8
votes
2answers
588 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...