Hot answers tagged

7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


6

Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


3

How easy is it to get the source code from a desktop application? If it is open source software it is easy. If not it is harder. Are there any protections in place to stop someone from viewing an application's code? This depends on the software. Usually you cannot get the full source back because in the process of compiling the original source is ...


2

I currently work as a developer, with some responsibility for sprint planning etc. so my answer is based mostly from a 'how should testing be accounted for' approach. I'm going to talk about agile here, but the same principal applies. I can't see anything wrong in principal with testing in parallel to QA, assuming that it's understood that anything which ...


2

Any OWASP project is as relevant as the community behind it, for example the PHP project is now abandoned but ASVS seems pretty active still. Adhering to any OWASP best practice is always a good idea, it may not be the perfect fit for your organization and you are not obliged to follow everything they say, but it certainly helps to steer you in the right ...


2

The only time I've ever seen anything similar to this is in Dovecot (IMAP email server) where you can optionally configure it to log a hash of the password attempted for troubleshooting/debugging purposes. However, even with Dovecot (which is an implementation I would trust more than what yours appears to be), it is only something I would enable temporarily ...


2

I can't see any security claims to the application to store the clients inputs. Also, the "ciphertext" seems to be reversible (instead of a hash). It's a bad practice.


2

The 2008 paper from Blake Franz of Leviathan Security -- http://www.leviathansecurity.com/white-papers/flirting-with-mime-types -- identifies some of the original problem spaces with character sets. Some tools correctly identify and explain this problem, such as Burp Suite Professional -- ...


1

"due to an incomplete QA on the feature, my security test cases gave false negatives" I don't really understand what you are trying to say here. Testing does not change the functionality, security, capacity or performance of the system. However the whole point of testing is to identify where the system does not deliver on any of these aspects (along ...


1

Source and sink are used in a data flow analysis. The source is where data comes from, the sink is where it ends. With regards to application security, source and sink are frequently used for taint analysis. Data is "tainted" if it comes from an insecure source such as a file, the network, or the user. Any data that touches data also becomes tainted. If ...


1

From Gray Hat Hacking The Ethical Hacker's Handbook, 4th Edition: Enumerating Named Pipes Named pipes are similar to shared sections in that developers used to think, incorrectly, that named pipes accept only trusted, well-formed data from users or programs running at the same privilege level as the program that has created the named pipe. ...


1

You can easily do this by being a good, secure user. Follow the basic tenants of security, and be careful of what you install on your phone. After all games are great, but not when they're really viruses. Since it sounds like you're really going for a super secure phone with data archiving and backup, don't install something unless you KNOW it's safe, and ...



Only top voted, non community-wiki answers of a minimum length are eligible