Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
1 vote
0 answers
20 views

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
user avatar
1 vote
1 answer
74 views

Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?

I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
user avatar
0 votes
0 answers
19 views

Android Keychain: How to restrict the system-wide credentials based on the app developer or manufacturer only?

As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain ...
user avatar
0 votes
1 answer
185 views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
user avatar
1 vote
1 answer
76 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
user avatar
0 votes
0 answers
32 views

How do you connect a piece of code in a repo to an actual user-input point in an app?

This is conceptual I know so let me know if there's a better place to ask this. I'm wondering how people can view a piece of code in a repo they aren't familiar with, or simply didn't write, and ...
user avatar
  • 123
0 votes
0 answers
34 views

Local attack vector and other metrics

While calculating the CVSS score using CVSS3.1, attack vectors are classified into four. Network - Remote attack Adjacent - Should share the same Physical or Logical network of victim Physical - ...
user avatar
0 votes
0 answers
68 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
user avatar
  • 1
11 votes
3 answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
user avatar
1 vote
0 answers
150 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
user avatar
  • 11
0 votes
3 answers
121 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
user avatar
1 vote
0 answers
89 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
user avatar
0 votes
1 answer
106 views

Security for website admin panel [closed]

I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
user avatar
  • 101
0 votes
1 answer
115 views

What are the risks to an app in supporting older iOS versions?

I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user avatar
2 votes
2 answers
395 views

Semicolon's relation with reverse proxy

What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache? Like I've seen multiple times where people have ...
user avatar
  • 23
0 votes
1 answer
177 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
user avatar
1 vote
2 answers
89 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
user avatar
  • 113
1 vote
1 answer
111 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
user avatar
1 vote
1 answer
84 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
user avatar
  • 1,247
1 vote
0 answers
110 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
user avatar
  • 390
0 votes
1 answer
212 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
user avatar
1 vote
0 answers
95 views

PII best practices

I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
user avatar
0 votes
1 answer
123 views

Content-Length based DoS

I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
user avatar
  • 1
2 votes
1 answer
102 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
user avatar
0 votes
2 answers
237 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
user avatar
  • 1
0 votes
0 answers
24 views

End-2-end encryption with WhatsApp [duplicate]

I have had recently gone through the horror of transferring WhatsApp conversations when changing phones (android for iPhone). Actually, the thing that it is close to impossible for everyday folk is a ...
user avatar
  • 105
0 votes
1 answer
87 views

Could a virus force a phone to download an app and spread it?

I'm writing a sci-fi story that includes a malicious app that spreads globally. The developer publishes an app without knowing it's infected, and it spreads because it forces phones to download it. ...
user avatar
0 votes
3 answers
191 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
user avatar
  • 347
1 vote
1 answer
111 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
user avatar
  • 1,224
1 vote
1 answer
90 views

Become a Cloud Security analyst [closed]

What learning path would you recommend for someone interesting in focussing on the Cloud Security side and considering remote work in the future? Many thanks
user avatar
  • 11
0 votes
0 answers
19 views

how to check if an app is safe [duplicate]

There is an app on Github I was in a rush, so I didn't check, but there is no explanation or source code in its repo. How could I check if it is not just sniffing my information or something? Is there ...
user avatar
0 votes
1 answer
157 views

Are weak entropy sources worth it?

I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
user avatar
0 votes
0 answers
127 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
user avatar
  • 1
0 votes
0 answers
152 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
user avatar
0 votes
4 answers
346 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
user avatar
  • 33
0 votes
1 answer
111 views

Protecting my machine from running untrusted applications

I was big fan of the Toontown Online MMO when Disney used to run it so I was excited to learn that it had been revived by a fan or group for fans building on the original source code. During a recent ...
user avatar
1 vote
0 answers
401 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
user avatar
  • 11
0 votes
1 answer
179 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
user avatar
0 votes
1 answer
311 views

Burp Suite upstream proxy

Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
user avatar
  • 187
0 votes
1 answer
230 views

Are rich-client apps inherently more secure than webapps? [closed]

If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF ...
user avatar
1 vote
2 answers
1k views

XSS in script tags application/json - possible?

Is there way to execute alert box if " is not correctly escaped and can be injected in example below? <script type="application/json">{"requests":{"postClicked"...
user avatar
1 vote
1 answer
152 views

XSS in my Web App? [closed]

I have developed web app, and my customer is saying this piece of code is vulnerable: <a href="#" onclick="count.it('count', 9); console.log(1);">Click "9" is ...
user avatar
0 votes
0 answers
27 views

Securing against scans [duplicate]

I have a VM which is exposed to the internet. I can see a lot of scans for /azenv.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and like in my server logs. How do I protect from these ...
user avatar
  • 103
1 vote
1 answer
136 views

How do I share secret key files with Docker containers following 12 Factor App?

I am building an API and trying to follow the 12 Factor App methodology. Using Docker, the methodology says containers must be disposable. Assuming the API will have high traffic, multiple docker ...
user avatar
  • 111
2 votes
3 answers
165 views

Should the pentester seek features to test by himself?

Imagine we have a dev team developers team lead scrum master ... When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it ...
user avatar
  • 89
5 votes
1 answer
513 views

What are the general security implications behind using a web app vs its equivalent desktop app?

In 2020, there are a lot of applications which have a web interface as well as "desktop apps." Such applications are either the same in functionality or very close. Three examples of this situation ...
user avatar
0 votes
1 answer
120 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
user avatar
62 votes
3 answers
7k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
user avatar
  • 2,914
0 votes
2 answers
138 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
user avatar
2 votes
1 answer
139 views

Is using the JWT token to perform queries, as opposed to a raw value in its payload, considered a good practice?

For my SPA app, I'm using Firebase as the authentication provider. I'm also using this token to authenticate with my back-end server. The Firebase documentation reads: "Warning: Do not accept ...
user avatar

1
2 3 4 5
19