Tag Info

New answers tagged

0

The additional (and corrected) data in your edit allowed me to get the last bit. Your first two steps, de-base64 and RSA-OAEP decrypt the working key, are now correct except a typo -aeop should be -oaep. Data decryption didn't quite work because as Tom Leek says in the linked item (but I missed the first time) XMLenc block cipher does NOT use PKCS7 padding ...


0

Amazon and others use "Universal Description, Discovery and Integration" (UDDI) which has it's own standard. Companies come together under the OASIS group to tackle standards with regards to SOA, UDDI, WSDL, SOAP, etc. There are many companies that address software to pull that off however, there are standards. I'd begin here for an index, then here, ...


2

There is a framework that exists specifically to enable this sort of scenario. It is called OAuth 2.0. What you want to do is to have an API that exposes the resource owners' (your users) resources (their pictures) for the client (the third party) to consume with the permission of the individual resource owners. So, in this model, you become an OAuth ...


1

First of all: Have you already checked with your legal department or a qualified lawyer if you are even allowed to do this according to your privacy policy and your local privacy laws? When you haven't, you must do this first. The main security problem is to find out which of their users are also your users. This is not as easy as it seems, because "Kevin" ...


0

There are a couple of potential risks here, depending on how exactly this is setup and what the requirements are. If end users can obtain direct access to layer red and can obtain valid credentials, they then have unfettered access to layer red using only those credentials, skipping the auth check on layer blue completely. If layer blue only exists as ...


2

This is a book on BASIC pentesting of webapps : http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166 I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.


2

As a starter owaspis always goodhttps://www.owasp.org/index.php/Main_Page you could also find some tools there. check the cheat sheet series too https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series


1

I see two possible attack vectors. eavesdropping cross site scripting vulnerabilities in your web application When the token isn't transmitted via HTTPS, it can be intercepted and used by an eavesdropper. To prevent this, enforce https for all communication. When the HTML document includes any data from a 3rd party, you need to be weary of XSS ...


1

However, the webservice for creating the account has no restrictions, meaning an attacker could spam GET requests to it from any device to create any number of users they want and flood the database/server. My question is, how can this be avoided? You can use a mix of CAPTCHA and IP restrictions to avoid such type of attack. IP restrictions: ...


-1

However, it's not login-based in the traditional sense that users don't sign up with an email or anything. We just automatically create an account for them with some randomly generated UUID as their "login" to the service. If you are just allowing ANY user to create an account with your application, without providing any personal information, it ...



Top 50 recent answers are included