New answers tagged

3

How easy is it to get the source code from a desktop application? If it is open source software it is easy. If not it is harder. Are there any protections in place to stop someone from viewing an application's code? This depends on the software. Usually you cannot get the full source back because in the process of compiling the original source is ...


0

What you are looking at is called an SID (Security Identifier). It is a unique and immutable value used to identify a security principal (includes machines, domain computer accounts, users) and security group in Windows OSs. Below is the structure of an SID: Common SID’s MS Developer Page lists these SIDs as non unique. From your example, it looks like ...


1

Any OWASP project is as relevant as the community behind it, for example the PHP project is now abandoned but ASVS seems pretty active still. Adhering to any OWASP best practice is always a good idea, it may not be the perfect fit for your organization and you are not obliged to follow everything they say, but it certainly helps to steer you in the right ...


2

The only time I've ever seen anything similar to this is in Dovecot (IMAP email server) where you can optionally configure it to log a hash of the password attempted for troubleshooting/debugging purposes. However, even with Dovecot (which is an implementation I would trust more than what yours appears to be), it is only something I would enable temporarily ...


2

I can't see any security claims to the application to store the clients inputs. Also, the "ciphertext" seems to be reversible (instead of a hash). It's a bad practice.


1

Source and sink are used in a data flow analysis. The source is where data comes from, the sink is where it ends. With regards to application security, source and sink are frequently used for taint analysis. Data is "tainted" if it comes from an insecure source such as a file, the network, or the user. Any data that touches data also becomes tainted. If ...


7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


1

"due to an incomplete QA on the feature, my security test cases gave false negatives" I don't really understand what you are trying to say here. Testing does not change the functionality, security, capacity or performance of the system. However the whole point of testing is to identify where the system does not deliver on any of these aspects (along ...


2

I currently work as a developer, with some responsibility for sprint planning etc. so my answer is based mostly from a 'how should testing be accounted for' approach. I'm going to talk about agile here, but the same principal applies. I can't see anything wrong in principal with testing in parallel to QA, assuming that it's understood that anything which ...


1

From Gray Hat Hacking The Ethical Hacker's Handbook, 4th Edition: Enumerating Named Pipes Named pipes are similar to shared sections in that developers used to think, incorrectly, that named pipes accept only trusted, well-formed data from users or programs running at the same privilege level as the program that has created the named pipe. ...


0

https://www.reddit.com/r/netsec/wiki/meetups/citysec This is ULtimate Resouces you will find in infosec field Period https://www.reddit.com/r/netsec/wiki/start


0

From the patch it can be seen that it is skipping any control and some more characters ([\x00-\x1f\x7f\xff]) when constructing the target file name: + * SECURITY: Skip past control characters if the user + * didn't OK use of absolute pathnames. lhh - this is + * a very quick, ugly, inefficient fix; it traverses + * the WHOLE ...


1

You can easily do this by being a good, secure user. Follow the basic tenants of security, and be careful of what you install on your phone. After all games are great, but not when they're really viruses. Since it sounds like you're really going for a super secure phone with data archiving and backup, don't install something unless you KNOW it's safe, and ...


-3

You have already said the answer to your question: I want to use a few apps (Titanium Backup, Droidwall and maybe XPrivacy) with root access in a "secure way", which means: I want to limit the security implications described above to the least possible. Yes, use those apps to secure your phone, but I do not recommend you to install some credit card ...


2

The 2008 paper from Blake Franz of Leviathan Security -- http://www.leviathansecurity.com/white-papers/flirting-with-mime-types -- identifies some of the original problem spaces with character sets. Some tools correctly identify and explain this problem, such as Burp Suite Professional -- ...


6

Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


2

I think your question is much broader than you realize, but I'll try to give some sort of answer. If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution ...


0

From my understanding there are 3 tracks on a card. Forget track 3 as it is not/hardly used. Swipe and sign cards (without EMV) have just track 1: %B1234567890123445^PADILLA/L.^99011200XXXX00000000?* EMV cards have track 2, which is just a copy of track 1, but without the first and second name in the middle: ...



Top 50 recent answers are included