Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
0 votes
1 answer
62 views

As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?

From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
0 votes
1 answer
73 views

What security reviews are done on apps in mobile app stores? [closed]

What checks (static analysis, dynamic analysis etc.) does Google, Apple, Amazon etc. do on their app stores with each app developer submit? Are they automatic or manual? Does any app store review ...
  • 129
3 votes
1 answer
101 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
  • 31
1 vote
1 answer
41 views

Is switching my C/C++ compiler for security testing generally reliable?

If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
  • 1,069
1 vote
1 answer
163 views

How does a non technical user/beginner vet Android apps to ensure they are safe?

Background I moved from ios to Android so now can't rely on Apple doing some checks on the apps. I was told that Google does some automated checks and if you buy/download apps from large organisations,...
  • 129
3 votes
5 answers
237 views

Session regeneration after password change?

So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
  • 31
1 vote
1 answer
62 views

What is the significance of an app leaking its access token - knowingly/unknowingly with just read access

I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
  • 23
1 vote
1 answer
62 views

Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?

For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
1 vote
1 answer
71 views

Vulnerabilities in Build-time Libraries Could be a Security Threat

If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
  • 111
1 vote
1 answer
128 views

How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?

There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE". ...
2 votes
0 answers
73 views

Securely store application secrets in production without 3rd party KMS

Integrated Security I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
  • 21
1 vote
3 answers
131 views

Why don't applications suggest passwords themselves?

Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
  • 227
0 votes
1 answer
84 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
0 votes
1 answer
61 views

Does the IDOR vulnerability have to be sensitive data?

I had a hard time convincing a bug I reported that it was a bug bounty program. It seems to be more of a discussion than a question. Scenario: Users shop on the shopping site. The categories of these ...
  • 3
0 votes
0 answers
53 views

How to manage the Open Source/Third Party libraries used in a big monolithic application?

I'm working on a big monolithic application which uses thousands of open source/third party libraries. It is painful every time if we need to upgrade or patch a component because of security ...
0 votes
0 answers
55 views

Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?

This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
0 votes
1 answer
40 views

Static react native app security issues

I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
1 vote
1 answer
46 views

Vulnerability: Standalone Library vs. Same Code Elsewhere

Are libraries inherently more vulnerable than in-house application code? The speaker of this talk generally advises folks against creating wrapper libraries for Erlang in Elixir rather than just ...
  • 182
1 vote
0 answers
64 views

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
1 vote
1 answer
325 views

Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?

I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
0 votes
1 answer
694 views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
2 votes
1 answer
88 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
0 votes
0 answers
76 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
  • 1
11 votes
3 answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
1 vote
0 answers
317 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
  • 11
0 votes
3 answers
171 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
1 vote
0 answers
91 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
0 votes
1 answer
155 views

Security for website admin panel [closed]

I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
  • 101
0 votes
1 answer
120 views

What are the risks to an app in supporting older iOS versions?

I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user avatar
3 votes
2 answers
783 views

Semicolon's relation with reverse proxy

What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache? Like I've seen multiple times where people have ...
  • 33
0 votes
1 answer
255 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
1 vote
2 answers
91 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
  • 113
1 vote
1 answer
116 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
1 vote
1 answer
86 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
  • 1,247
1 vote
0 answers
156 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
0 votes
1 answer
326 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
1 vote
0 answers
118 views

PII best practices

I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
  • 111
0 votes
1 answer
323 views

Content-Length based DoS

I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
  • 1
2 votes
1 answer
111 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0 votes
2 answers
554 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
  • 1
0 votes
0 answers
25 views

End-2-end encryption with WhatsApp [duplicate]

I have had recently gone through the horror of transferring WhatsApp conversations when changing phones (android for iPhone). Actually, the thing that it is close to impossible for everyday folk is a ...
  • 125
0 votes
1 answer
88 views

Could a virus force a phone to download an app and spread it?

I'm writing a sci-fi story that includes a malicious app that spreads globally. The developer publishes an app without knowing it's infected, and it spreads because it forces phones to download it. ...
0 votes
3 answers
256 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
  • 357
3 votes
2 answers
166 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
  • 1,240
1 vote
1 answer
94 views

Become a Cloud Security analyst [closed]

What learning path would you recommend for someone interesting in focussing on the Cloud Security side and considering remote work in the future? Many thanks
  • 11
0 votes
0 answers
20 views

how to check if an app is safe [duplicate]

There is an app on Github I was in a rush, so I didn't check, but there is no explanation or source code in its repo. How could I check if it is not just sniffing my information or something? Is there ...
0 votes
1 answer
183 views

Are weak entropy sources worth it?

I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
0 votes
0 answers
200 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
  • 1
0 votes
0 answers
166 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
0 votes
4 answers
704 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
  • 43

1
2 3 4 5
20