11
votes
4answers
662 views

Vulnerabilities common only in mobile solutions?

I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier. I haven't heard of any serious or common problems that ...
8
votes
3answers
476 views

What security features should be present in every web-based CMS?

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do? Please note: I'm looking ...
6
votes
3answers
315 views

How to open a file from the Internet in a secure way?

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer. How could I mitigate the risk and open them in a more or less ...
22
votes
6answers
1k views

Online password managers

Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
19
votes
2answers
4k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
18
votes
4answers
3k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
7
votes
3answers
2k views

Management Network Best Practices

I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc). ...
24
votes
11answers
4k views

Resources to learn about security

I am currently just finishing a undergrad computer science degree, but I know very little about computer security. What are some good resources (aside from this site) to learn the fundamentals of ...
11
votes
5answers
3k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
8
votes
4answers
3k views

How effective are reverse proxies as a web application security measure?

How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they? For example are they more effective in preventing ...
53
votes
13answers
11k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
9
votes
3answers
753 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
9
votes
2answers
2k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
8
votes
1answer
556 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
13
votes
4answers
6k views

Does a webserver need an antivirus software installed?

In what cases does a webserver need an antivirus software installed? When it is not required? If it is required sometimes, what should be considered when choosing the right one to install? (In my ...
7
votes
2answers
898 views

Recently had a virus, can I use backed up files on clean system?

I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in ...
24
votes
2answers
3k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
9
votes
4answers
290 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
17
votes
3answers
2k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
27
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
21
votes
3answers
559 views

Startup security

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
12
votes
5answers
2k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
17
votes
3answers
3k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
10
votes
4answers
172 views

Is external vuln scanning sufficient?

Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it? From the original Area51 proposal.
283
votes
11answers
50k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
9
votes
2answers
204 views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
23
votes
10answers
4k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
8
votes
5answers
410 views

Encrypting a disk that has stuff on it?

Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
9
votes
7answers
671 views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...
8
votes
5answers
1k views

Creating tunnel with most ports closed?

How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
39
votes
5answers
4k views

New XSS cheatsheet?

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
12
votes
3answers
587 views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
20
votes
4answers
10k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
18
votes
4answers
1k views

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
15
votes
6answers
939 views

What are a few good lists of threats to use to kick-off conversations with others about what worries them?

To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
22
votes
4answers
584 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
4
votes
2answers
1k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
9
votes
4answers
1k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
11
votes
4answers
1k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
34
votes
9answers
9k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
23
votes
9answers
8k views

Do secure phone lines exist?

I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure . I know that Skype and other VOIP service providers have to ...
18
votes
7answers
2k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
11
votes
4answers
309 views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
13
votes
1answer
194 views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of ...
10
votes
2answers
1k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
23
votes
8answers
10k views

Can I detect web app attacks by viewing my Apache log file?

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
7
votes
4answers
262 views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
40
votes
6answers
13k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
12
votes
2answers
288 views

What is the best way to verify the SSL configuration of my web server?

How do I ensure I have my SSL configuration setup securely?

15 30 50 per page