Hot answers tagged owasp
10
My experience is it depends on industry, regulations, and business relationships (not necessarily company size).
Examples:
<10 person company, building a web app that retrieves credit
history, they were required by business partners to have a full
webapp pentest
<50 person company, building a web portal allowing
customers to view point of sale ...
9
Short answer : NO.
It is indeed shocking to know that most companies do not care about the security stature of their product or are ignorant about it. Usually, the QA teams in these companies perfrom the testing, and maybe the test cases would include some attack vectors for XSS, SQLi etc. But I'm pretty sure that they would not have a dedicated process ...
7
To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes.
As far as security best practices, I have several suggestions:
To avoid XSS, abide by the rules found ...
6
A few issues I found developing a team's secure programming guide recently:
How will the guidelines be enforced or encouraged? Who will be responsible for ensuring that products developed in accordance with your guidelines? You need to ensure that this person can:
see whether the guides are being adhered. This means they need to look into code reviews and ...
6
There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave
Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...
6
The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use ...
5
I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates ...
5
The core mindset you want is:
Build it as if it were real, not virtual.
What would you want in place? Firewalls, access controls, logging etc
For a lab running virus analysis etc., you would normally segregate that from the rest of your network, so do the same here. I don't know of any malware yet that is specifically designed to break out of a VM in ...
4
@Graham's answer is very good, a few additional points to consider:
You'll need a different set of guidelines for each programming language / technology / platform. C++ coding guidelines, have a lot in common with .NET guidelines, but even more not in common.
They should preferably be tailored to your projects context / needs / technology / etc (e.g. ...
4
Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts.
Revalidating Data From Redirect
OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...
4
What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it?
Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b>
If the ...
3
I recommend looking at Microsoft's Security Development Lifecycle (SDL). They have a lot of great resources.
Also look at BSIMM and OpenSAMM.
Some related questions and information:
Secure Software Development
Reading about security by design?
How and where to begin on the Return of Web Application Security Investment?
What is considered the simplest ...
3
A common practice after a form post is to redirect a user to success page:
POST /my-form HTTP/1.1
Host: www.myhost.com
HTTP/1.1 302 Moved Temporarily
Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E
In this example the user is redirected to the form-success.html page, with the message of:
<b>Success!</b>
...
3
Without providing more detail about your web services, I would say yes there is a very good chance it is. However the exploit is probably not what would expect as it is different from your usual HTTP POST/GET CSRF exploit. In the case of SOAP or other web services the body of the message is XML or some other block of data. When I write PoC CSRF exploits ...
3
Setting up a vulnerable web app in a virtual machine is relatively safe. The risk is an attacker gaining access to that VM over the network, so as long as you restrict network access to the virtual machine there won't be a problem.
As I understand it by default VMWare (and other VM software) will be configured in this way.
Realistically if you have your ...
3
Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.
...
2
There aren't any online services that I'm aware of that (intentionally) allow this type of behavior. If this is something you think you'll do on a regular basis, I highly recommend you look at Web Scarab or Pinata
2
If you can provide the lines in your log file showing what rule is causing the block it would be helpful.
An option would be to use SecRuleRemoveByID to disable the rule that is causing your block.
Alternatively you can white list IP address using a number of different techniches which are listed here
2
Peculiar, but you're not the first person to ask about it, and there's even a suggested implementation for CSRF protection there + the code hosted on github. I can't really vouch for this mechanism though, haven't really inspected it too closely.
Interesting question. It does seem to me that phpbb went a little over-the-top with the implementation, but ...
2
In terms of more content you could cover the Sammy Worm and how it avoids he problem of HTTPOnly cookies entirely. Its important to note that XSS is a lot more than just document.cookie and PoC alert boxes. CSRF becomes very difficult to prevent, but not impossible. Captcha's can be used to prevent CSRF even if XSS is present (defense in depth). In fact ...
2
The OWASP Top 10 is a great idea for content - although as you may see from my other posts, I always recommend a piece around business practicality, so if you can combine the talk with information on implementation and business risk I think it can make a very powerful presentation.
For example, incorporating information on how complex remediation for each ...
2
I think the best way to describe canonicalization is to remember that it stems from canon, meaning an authentic piece of writing. What they're talking about is taking untrusted data and formatting it as an unambiguous representation, such that it can never be misrepresented by any software process.
The first step is to take your input and store it ...
2
Your question is probably not answerable here in its current form. The entire point of the OWASP mobile security project is that there are a great many threats, of which the top ten are listed, and a large number of mitigating controls or activities.
Insecure Data Storage
Weak Server Side Controls
Insufficient Transport Layer Protection
Client Side ...
2
Check out Safelight Security. They are focused on application security training have an entire curriculum for developers. Full disclosure - I work for Safelight! If you want to get information, you can request it directly from Larry Gorkun lgorkun@safelightsecurity.com.
2
You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect.
Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If ...
1
Standard practice is for your client to engage a security test, but I am seeing more developers hiring security testers to provide some assurance to the client.
But there is no way to say 'this code is guaranteed secure' - there is only 'this code seems appropriately secure' or 'fit for purpose'
1
I think that for many small businesses, it is easier to hope that it doesn't happen to you than to spend more on security than you did on creating the website.
Given 1) the ease of hacking SMBs and 2) the relative low risk, one would think that on a risk return basis, these would be the prime targets for hackers.
1
Oh uggh! It's an interesting problem, as some of the bigger LDAP providers (that's you AD!) don't even recognize services as securables and IMHO they really should - IFF you have the ability to use some standardized LDAP provider for role management, then you can trawl a lot of vendor offerings for tools to help you in this - bottom line is don't roll your ...
1
As Mark Hillick said, we'd have to see the mod_security audit logs to answer this. The logs will show just which OWASP rules are being matched. You could then read the documentation for the rule(s) here. Or you could post a couple of examples of the logs here, showing the specific matches. Then we could better help sort this out with you.
Only top voted, non community-wiki answers of a minimum length are eligible
