Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

2
votes
1answer
33 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
0
votes
0answers
101 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
0
votes
1answer
36 views

How much bug bounty should I expect from a organization who runs bug bounty program for the vulnerability? [on hold]

How much bug bounty should I expect from a organization who runs bug bounty program for the vulnerability : Takeover of entire application instance by taking over an admin account using CSRF attack ...
2
votes
1answer
53 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
1
vote
2answers
49 views

Are there security pitfalls on relying on an emails domain to automatically assign permissions?

I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email). ...
1
vote
0answers
20 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
0
votes
2answers
103 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
0
votes
0answers
11 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
1
vote
0answers
35 views

OWASP Testing Guide Equivalent for Desktop Applications [closed]

I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications? I had no luck searching the Internet. I am looking for something ...
0
votes
0answers
26 views

OAuth 2 Client Credentials within Mobile App

I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
8
votes
1answer
240 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
0
votes
0answers
11 views

Assessing 3rd party/COTS desktop applications (Newbie question)

How common is it to assess desktop applications for security before adding them to a company portfolio? My employer has a growing portfolio of desktop applications bought from a wide range of vendors,...
10
votes
3answers
368 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
1
vote
0answers
66 views

Do WebEx's requirements open security holes?

After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites: ...
2
votes
0answers
24 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
0
votes
1answer
95 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
0
votes
0answers
24 views

How would attackers bypass Token Binding?

Token binding is not easy to implements across organizations to support Bearer Tokens. The problem with Bearer Token is that merely having it even if it was stolen will be enough to use (same idea as ...
1
vote
1answer
59 views

Can someone highlight the key difference between CRLF Injection, HTTP Response Splitting and HTTP Header Injection?

I believe each one of these is closely interlinked, for instance, HTTP Response Splitting will occur in event of CRLF characters injection (%0d%0a) and this will also involve injection of HTTP headers ...
0
votes
0answers
69 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
0
votes
0answers
39 views

When developing a web application why should I enable case sensitivity for routes and strict routing mode?

Example for enabling case sensitivity will be for example "/show" route is not the same as "/Show". What are the best security best practice will be here? I was also wondering if I should enable ...
0
votes
3answers
108 views

Should I block a user from using banking app if they fake the location?

I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
1answer
48 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
1answer
88 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
1
vote
2answers
60 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
4
votes
3answers
390 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
0
votes
0answers
26 views

Suggestion for intercepting traffic with android app [duplicate]

Are there any tools that I can use to intercept the traffic of android app? I tried Charles proxy and Burp suite but they only support HTTP/HTTPS traffic. I have to pentest a game, basically it's ...
0
votes
1answer
367 views

XSS payload without html tags [duplicate]

Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.
0
votes
0answers
27 views

JSP example scripts residing on the server

On one of the web applications I am checking, running a nikto scan revealed the following 'examples' folder in the web-root with the following contents. While I will definitely suggest to remove them, ...
0
votes
1answer
57 views

Applying regexp for user input validation using JavaScript

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
5
votes
1answer
107 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
2
votes
1answer
61 views

Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp. However, this app has an oAuth token ...
0
votes
1answer
50 views

Can a secure invitation link be sent client-side only?

One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with ...
3
votes
0answers
82 views

String Serialization in .NET [closed]

I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET ...
3
votes
1answer
90 views

Alternative to client certificate authentication with HTTP/2

We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2. We are investigating ...
0
votes
0answers
19 views

Protecting API - Using 3rd party? or Application Firewall? [duplicate]

Our company has a mobile app with a lot of traffic and we want to protect its API. How can we reduce brute force attacks? Does account lockout is the fastest and proper way to achieve protection? We ...
4
votes
3answers
235 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...
4
votes
2answers
148 views

Can results from DAST (Dynamic Application Security Testing) tools be false positive?

I know results from Static Application Security Testing (SAST) can be false positives or real and it is up to the security analyst and developer to decide which vulnerability is real based on the ...
2
votes
1answer
80 views

What is the relationship between HTTP response codes and successful execution of XSS attacks?

What is the relationship between HTTP response codes and successful execution of XSS attacks? For e.g I am using a commercial vulnerability scanner that reports XSS vulnerability found in a certain ...
0
votes
1answer
835 views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
1
vote
0answers
49 views

Review: Security model for sync service [closed]

I am working on a sync service for my desktop app. The app tracks (with the user's consent) some computer usage data (comparable in terms of sensitivity to their browser history), so I'd like for this ...
4
votes
1answer
166 views

Inspecting code elements in browser when logging in

When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
-5
votes
1answer
111 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
0answers
23 views

Can I perform a basic web application security test of a web application from a pcap file

I have been trying to run zed attack proxy against a web application using some automated functional tests. ZAP keeps failing at some point due to sslsocket exceptions (I think due to making requests ...
3
votes
2answers
92 views

Turing-completeness impact on system security

I always find in many papers discussing different kind of system security subject that the authors always trying to highlight the danger of some vulnerabilities by assuming an attacker, by exploiting ...
5
votes
1answer
294 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
4
votes
1answer
125 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
0
votes
1answer
119 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
0
votes
1answer
414 views

How to prevent users from retrieving the Java source code from a jar/exe file that I am distributing openly? [duplicate]

I guess Java jar files can be reversed back to the source code and I want to prevent it from happening that easily. What I did was to convert the jar file into a Windows native exe file using launch4j....
1
vote
1answer
103 views

Application and Information Security software development market [closed]

This is a question more about how the market is for a software engineer with a focus on application and information security, mainly development and software engineering, either of secure practices ...
1
vote
2answers
232 views

Storing certificate bundles (.pfx files)

In an application deployed across multiple environments (e.g. Test/Prod), what's a good practice for storing the environment specific certificate bundle (.pfx file)? Is password protecting the .pfx ...