Questions tagged [appsec]
Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.
974
questions
0
votes
0
answers
22
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
0
votes
1
answer
37
views
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
- 9
1
vote
0
answers
73
views
Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?
I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
- 111
2
votes
2
answers
78
views
Standards for Secure Products
I am interested in standardizations for secure design and development of products, especially towards operational technology / IoT / ICS. My understanding of information security management systems ...
- 71
1
vote
0
answers
49
views
Learning Desktop Application Security
I am familiar with web security but I would like to know more about non-web application security.
I know about memory corruption vulnerabilities like buffer overflow and buffer overread and how ...
0
votes
0
answers
71
views
CSP script-scr blob
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
1
vote
1
answer
278
views
Burp DOM-based Open Redirect
When I sent a request such as:
GET /500.aspx?aspxerrorpath=/error.aspx HTTP/1.1
Host: test.com
Burp reports "The application may be vulnerable to DOM-based open redirection:
Data is read from ...
- 13
-1
votes
2
answers
239
views
Strategy for storing private keys used in an embedded device
I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
- 429
2
votes
0
answers
116
views
Authorization and permissions in backend
My Dev team creates high-load applications and wants to use Keycloak with OpenID authz. But they are complaining about delays for retrieving permissions from Authz server (Keycloak). So, they decided ...
- 33
0
votes
1
answer
113
views
Which kind of data breaches or risk can happen if there is no virtual/physical disk encryption
There is an Azure-based internal database server and is not public-facing. There is another front-end application. A specific user group can connect with a VPN. There is no encryption applied at the ...
1
vote
0
answers
77
views
Is it okay to have exposed Google API key [duplicate]
After running MobSF static analysis on an application, the scan detected google_api_key as a possible hardcoded secret. Should Google API keys be encrypted ? Or is it okay to have them exposed if you ...
0
votes
2
answers
122
views
As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
- 1,554
0
votes
1
answer
101
views
What security reviews are done on apps in mobile app stores? [closed]
What checks (static analysis, dynamic analysis etc.) does Google, Apple, Amazon etc. do on their app stores with each app developer submit? Are they automatic or manual?
Does any app store review ...
- 129
3
votes
1
answer
166
views
How to design a desktop application that has access to a database via LAN?
As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
- 31
1
vote
1
answer
57
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 1,149
1
vote
1
answer
211
views
How does a non technical user/beginner vet Android apps to ensure they are safe?
Background
I moved from ios to Android so now can't rely on Apple doing some checks on the apps.
I was told that Google does some automated checks and if you buy/download apps from large organisations,...
- 129
2
votes
5
answers
2k
views
Session regeneration after password change?
So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
- 21
1
vote
1
answer
183
views
What is the significance of an app leaking its access token - knowingly/unknowingly with just read access
I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
- 23
1
vote
1
answer
90
views
Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?
For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
- 11
1
vote
1
answer
157
views
Vulnerabilities in Build-time Libraries Could be a Security Threat
If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
- 111
1
vote
1
answer
306
views
How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?
There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE".
...
- 13
3
votes
0
answers
229
views
Securely store application secrets in production without 3rd party KMS
Integrated Security
I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
- 31
1
vote
3
answers
149
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 227
0
votes
1
answer
206
views
Secure chat application with multiple users on one device?
I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.
My thought was to store a private key in ...
- 121
0
votes
1
answer
78
views
Does the IDOR vulnerability have to be sensitive data?
I had a hard time convincing a bug I reported that it was a bug bounty program. It seems to be more of a discussion than a question.
Scenario: Users shop on the shopping site. The categories of these ...
- 3
0
votes
0
answers
94
views
Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?
This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
- 109
0
votes
1
answer
62
views
Static react native app security issues
I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
- 103
1
vote
1
answer
64
views
Vulnerability: Standalone Library vs. Same Code Elsewhere
Are libraries inherently more vulnerable than in-house application code?
The speaker of this talk generally advises folks against creating wrapper libraries for Erlang in Elixir rather than just ...
- 202
1
vote
0
answers
142
views
Penetration testing framework for Windows Desktop applications
Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
- 11
1
vote
1
answer
644
views
Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?
I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
1
vote
1
answer
1k
views
What would be the best way to mitigate Azure Application Gateway WAF False Positive?
We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
- 248
2
votes
1
answer
119
views
Which CSP implementation is more secure?
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
- 197
0
votes
0
answers
89
views
How to protect a web app against supply chain attacks?
I'm looking for ways to further protect my web app against supply chain attacks.
Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
- 1
11
votes
3
answers
3k
views
Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe
If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
- 119
1
vote
0
answers
444
views
How to decode ysoserial .net payload
Is there any way to decode ysoserial .net payload?
For instance
I'm creating payload with:
ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity
Is there any ...
- 11
0
votes
3
answers
235
views
Security issues of exposing CRUD operations through a single API endpoint?
Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body.
{
"action":"[create|read|update|...
1
vote
0
answers
101
views
I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?
Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
- 111
0
votes
1
answer
201
views
Security for website admin panel [closed]
I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
- 101
0
votes
1
answer
137
views
What are the risks to an app in supporting older iOS versions?
I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user260465
3
votes
2
answers
1k
views
Semicolon's relation with reverse proxy
What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache?
Like I've seen multiple times where people have ...
- 33
0
votes
1
answer
372
views
Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)
I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time.
I understand that both methods require to prove that the certificate (...
- 173
1
vote
2
answers
100
views
Securing APIs used by remote devices
We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
- 113
1
vote
1
answer
139
views
How do Services recognise 2-Factor Authentication codes as correct?
Something about the flow of setting up 2-factor authentication is not clear to me.
This is the flow of setting up a Service* to use a 2-factor auth app**:
Choose setup 2-factor auth in the account ...
- 13
1
vote
1
answer
95
views
Is an outdated library in a Windows user mode desktop application an actual security risk?
I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example:
This ...
- 1,247
1
vote
0
answers
210
views
Application Layer security vs Transport layer security [closed]
Application layer security or transport layer security which one is better?
TLS is convenient but application layer security will help to provide more security as this post explains
0
votes
1
answer
391
views
Python desktop application: storing cloud database passwords
I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3).
An issue arises ...
1
vote
0
answers
146
views
PII best practices
I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
- 111
1
vote
1
answer
642
views
Content-Length based DoS
I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
- 11
2
votes
1
answer
144
views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
- 21
1
vote
2
answers
856
views
JWT is being sent in cookies, but when I try for CSRF they are not sent
I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT.
I was under the ...
- 11