Tag Info

Hot answers tagged

22

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


9

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...


9

Short answer : NO. It is indeed shocking to know that most companies do not care about the security stature of their product or are ignorant about it. Usually, the QA teams in these companies perfrom the testing, and maybe the test cases would include some attack vectors for XSS, SQLi etc. But I'm pretty sure that they would not have a dedicated process ...


9

My experience is it depends on industry, regulations, and business relationships (not necessarily company size). Examples: <10 person company, building a web app that retrieves credit history, they were required by business partners to have a full webapp pentest <50 person company, building a web portal allowing customers to view point of sale ...


9

The basic piece of HTTP Response Splitting (HRS) that gets left out most often, is the proxy. HRS is not an attack between a webserver and a browser, or even a browser and a webserver. The attack is on the idiosyncrasies of semi-compliant HTTP devices, namely, the web server and the web proxy. Specifically, the attack takes advantage of the fact that the ...


8

To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes. As far as security best practices, I have several suggestions: To avoid XSS, abide by the rules found ...


8

The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use ...


6

Also, why is whitelist approach better than blacklist approach as mentioned by OWASP. Why not just block a handfull of characters used in XSS like < , > , etc Blacklists are static in the sense, they prevent 'known bad' from happening. The problem with this is, there are new attack vectors found everyday and you would need to constantly update ...


5

The core mindset you want is: Build it as if it were real, not virtual. What would you want in place? Firewalls, access controls, logging etc For a lab running virus analysis etc., you would normally segregate that from the rest of your network, so do the same here. I don't know of any malware yet that is specifically designed to break out of a VM in ...


5

I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates ...


5

Actually there is another more important one, due to the lack of a time constant implementation of equals, a timing attack can be used to work out magic. See http://codahale.com/a-lesson-in-timing-attacks/ public static boolean isEqual(byte[] a, byte[] b) { if (a.length != b.length) { return false; } int result = 0; for (int i = 0; ...


4

It is not just a block of handful characters that you need to blacklist. In security we go by this dogma: "There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know." Blacklist might help you ...


4

I think you might have rejected ESAPI too quickly. To defend against XSS, I recommend you do output escaping: any place where you insert data dynamically into an HTML document, escape the data (in a way suitable for that parse context). ESAPI provides libraries for the escaping and is very useful. This does not involve "changing your input". For more, ...


4

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


4

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the ...


4

Standard practice is for your client to engage a security test, but I am seeing more developers hiring security testers to provide some assurance to the client. But there is no way to say 'this code is guaranteed secure' - there is only 'this code seems appropriately secure' or 'fit for purpose'


4

@Graham's answer is very good, a few additional points to consider: You'll need a different set of guidelines for each programming language / technology / platform. C++ coding guidelines, have a lot in common with .NET guidelines, but even more not in common. They should preferably be tailored to your projects context / needs / technology / etc (e.g. ...


4

From an auditor's point of view, I do not expect you to go through every single line of code of used libraries IF the library is commonly used and vetted. If you are using "random code you found on the internet" for a transaction system then I expect you to have had a review on the code. Now for the more used and vetted libraries I would simply review the ...


3

I recommend looking at Microsoft's Security Development Lifecycle (SDL). They have a lot of great resources. Also look at BSIMM and OpenSAMM. Some related questions and information: Secure Software Development Reading about security by design? How and where to begin on the Return of Web Application Security Investment? What is considered the simplest ...


3

A common practice after a form post is to redirect a user to success page: POST /my-form HTTP/1.1 Host: www.myhost.com HTTP/1.1 302 Moved Temporarily Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E In this example the user is redirected to the form-success.html page, with the message of: <b>Success!</b> ...


3

There are many factors to worry about when exposing IDs to the public. I believe the most important one is to avoid crawlers. If I know that /page.php?id=1 will display information relative to a record in the database, then /page.php?id=2 must display information of the next record in order, and /page.php?id=3 is the next and so on, so I can read all the ...


3

Without providing more detail about your web services, I would say yes there is a very good chance it is. However the exploit is probably not what would expect as it is different from your usual HTTP POST/GET CSRF exploit. In the case of SOAP or other web services the body of the message is XML or some other block of data. When I write PoC CSRF exploits ...


3

Yes there is. http://tomengineering.tripod.com/gettopost.html


3

Setting up a vulnerable web app in a virtual machine is relatively safe. The risk is an attacker gaining access to that VM over the network, so as long as you restrict network access to the virtual machine there won't be a problem. As I understand it by default VMWare (and other VM software) will be configured in this way. Realistically if you have your ...


3

The name 'Broken Web Applications' infer that they are a collection of applications which has insecure code deliberately put together for educational or practice purposes. Using Bridged mode means, other users in your network can connect to this host. So technically if you are running 'OWASP BWA' using bridged mode, others in your network or LAN can ...


3

When a character has syntactical meaning in any context, you should be wary, and err on the side of escaping it. If for instance an attacker has found a way to inject it at the end of some existing tag, they can create a tag like <br /> which does not require ending; the transformation could change the meaning of the document. I apologize that I ...


3

Your question asks "Why /?". However you don't seem to be concerned about >, " and '? Technically, to ensure security within element content you only need to encode the < and & characters because HTML tags cannot start with >, ", ' or /, nor can an element start delimiter (<) be escaped by either of them (which is why you need & to be ...



Only top voted, non community-wiki answers of a minimum length are eligible