Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

0
votes
0answers
68 views

Secure coding standards and guidelines

I was trying to research on available secure coding guidelines of server-side and client-side languages. There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 ...
1
vote
1answer
59 views

Is using a web service in a browser safer than running it natively installed?

let's take a theoretical app that has both an installable version and a web version. I use it via my web browser or I can install the app. What are the safety considerations for the host operating ...
1
vote
1answer
94 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
6 views

Dangerous MySQL functions [migrated]

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...
64
votes
4answers
9k views

Is an up-to-date browser secure on an out-of-date OS?

Windows 7 support will end on January 14, 2020. Assuming that after that day I still use an updated browser, is it true that I'm still safe? Can it "patch" the OS-based security holes? Minor question:...
0
votes
0answers
75 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
1
vote
0answers
63 views

What are the security controls to consider to prevent usage of malicious SDK when developing our fintech mobile app? [closed]

We develop a financial application that will allow payment and other important actions, we also use some SDKs to help us with some functions. Including SDK in our app based on what I understand will ...
0
votes
0answers
52 views

iOS Security Architecture-Encryption Keys

As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave. The application processor and Secure ...
1
vote
0answers
28 views

How x-permitted-cross-domain-policies is different from CORS(cross origin resource sharing)? [duplicate]

OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...
0
votes
0answers
29 views

Sqlmap - Getting Strange Table Names

I am running sqlmap on folllowing target and getting some weird table names as output. I am not sure why i am getting this as output. The backend dbms is SQLite.Can someone help in that why i am ...
0
votes
2answers
168 views

XSS possible inside the value field of input tag when double quote is filtered?

Is it possible to get XSS in the value field of Input tag when the application filters out double quote? <input type="hidden" name="something" id="somenthing" value="my_input_goes_here"> input ...
0
votes
1answer
54 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
2
votes
2answers
71 views

Could always-listening mobile apps secretly spy on conversations?

Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
2
votes
0answers
183 views

How apps manage to prevent bypassing SSL pinning using Xposed framework?

We all know how to bypass SSL pinning using Xposed Framework module - SSLUnpinning. But I've found apps which cannot be bypassed this way. How do these apps prevent bypass of the SSL pinning which is ...
1
vote
0answers
44 views

What exactly is URL-safe Base 64 encoding? [closed]

And how is it different form the normal Base 64 encoding?
1
vote
0answers
37 views

Is perceptual hashing feasible to identify users [closed]

I have been shadow-banned on an app (Tinder) and I cannot get around it. I have been doing some background research into how they are able to identify me and have come across device fingerprinting (I ...
0
votes
1answer
79 views

Attacking an HTTPS site from an HTTP site in the same browser

A victim has two tabs open. One tab has an HTTPS site and one tab has HTTP site. What are the ways to attack HTTPS (https://www.example.com) site from HTTP site (http://somerandomdomain.com)? Here is ...
0
votes
0answers
28 views

Enterprise Mobile Application Security Options?

Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
0
votes
1answer
267 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...
1
vote
1answer
40 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
10
votes
5answers
412 views

Declaring “this is data, not code” to protect against injection attacks. What's the word for that?

There are a variety of ways to make sure a receiving system understands "this is data, not code" so that it doesn't try to execute or interpret the data. To name a few: Prepared statements, to avoid ...
4
votes
2answers
218 views

Upload malware to F-Droid repo?

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
0
votes
0answers
21 views

what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]

Background : Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login. Problem statement : What were the possible ...
0
votes
1answer
325 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
1
vote
0answers
180 views

Is there a way to replay WebSocket messages? [closed]

Burp Suite can intercept WebSocket messages ("WebSockets history" under "Proxy" tab) but does not seem to be able to resend (at least not yet, according to this). I was wondering what techniques or ...
3
votes
1answer
86 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
1
vote
0answers
182 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
5
votes
3answers
256 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
1
vote
2answers
86 views

Are there security pitfalls on relying on an emails domain to automatically assign permissions?

I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email). ...
1
vote
0answers
30 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
2answers
163 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
0answers
26 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
0answers
125 views

OWASP Testing Guide Equivalent for Desktop Applications [closed]

I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications? I had no luck searching the Internet. I am looking for something ...
8
votes
1answer
274 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
11
votes
3answers
402 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
1
vote
0answers
83 views

Do WebEx's requirements open security holes?

After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites: ...
3
votes
0answers
37 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
0
votes
1answer
101 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
1
vote
1answer
82 views

Can someone highlight the key difference between CRLF Injection, HTTP Response Splitting and HTTP Header Injection?

I believe each one of these is closely interlinked, for instance, HTTP Response Splitting will occur in event of CRLF characters injection (%0d%0a) and this will also involve injection of HTTP headers ...
0
votes
0answers
91 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
0
votes
3answers
114 views

Should I block a user from using banking app if they fake the location?

I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
1answer
117 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
1answer
132 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
1
vote
2answers
63 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
4
votes
3answers
441 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
0
votes
1answer
953 views

XSS payload without html tags [duplicate]

Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.
0
votes
0answers
28 views

JSP example scripts residing on the server

On one of the web applications I am checking, running a nikto scan revealed the following 'examples' folder in the web-root with the following contents. While I will definitely suggest to remove them, ...
0
votes
1answer
193 views

Applying regexp for user input validation using JavaScript

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
5
votes
1answer
115 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
2
votes
1answer
109 views

Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp. However, this app has an oAuth token ...