Questions tagged [appsec]
Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.
964
questions
0
votes
1
answer
62
views
As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
- 1,542
0
votes
1
answer
73
views
What security reviews are done on apps in mobile app stores? [closed]
What checks (static analysis, dynamic analysis etc.) does Google, Apple, Amazon etc. do on their app stores with each app developer submit? Are they automatic or manual?
Does any app store review ...
- 129
3
votes
1
answer
101
views
How to design a desktop application that has access to a database via LAN?
As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
- 31
1
vote
1
answer
41
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 1,069
1
vote
1
answer
163
views
How does a non technical user/beginner vet Android apps to ensure they are safe?
Background
I moved from ios to Android so now can't rely on Apple doing some checks on the apps.
I was told that Google does some automated checks and if you buy/download apps from large organisations,...
- 129
3
votes
5
answers
237
views
Session regeneration after password change?
So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
- 31
1
vote
1
answer
62
views
What is the significance of an app leaking its access token - knowingly/unknowingly with just read access
I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
- 23
1
vote
1
answer
62
views
Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?
For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
- 11
1
vote
1
answer
71
views
Vulnerabilities in Build-time Libraries Could be a Security Threat
If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
- 111
1
vote
1
answer
128
views
How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?
There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE".
...
- 13
2
votes
0
answers
73
views
Securely store application secrets in production without 3rd party KMS
Integrated Security
I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
- 21
1
vote
3
answers
131
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 227
0
votes
1
answer
84
views
Secure chat application with multiple users on one device?
I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.
My thought was to store a private key in ...
- 121
0
votes
1
answer
61
views
Does the IDOR vulnerability have to be sensitive data?
I had a hard time convincing a bug I reported that it was a bug bounty program. It seems to be more of a discussion than a question.
Scenario: Users shop on the shopping site. The categories of these ...
- 3
0
votes
0
answers
53
views
How to manage the Open Source/Third Party libraries used in a big monolithic application?
I'm working on a big monolithic application which uses thousands of open source/third party libraries. It is painful every time if we need to upgrade or patch a component because of security ...
0
votes
0
answers
55
views
Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?
This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
- 109
0
votes
1
answer
40
views
Static react native app security issues
I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
- 103
1
vote
1
answer
46
views
Vulnerability: Standalone Library vs. Same Code Elsewhere
Are libraries inherently more vulnerable than in-house application code?
The speaker of this talk generally advises folks against creating wrapper libraries for Erlang in Elixir rather than just ...
- 182
1
vote
0
answers
64
views
Penetration testing framework for Windows Desktop applications
Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
- 11
1
vote
1
answer
325
views
Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?
I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
0
votes
1
answer
694
views
What would be the best way to mitigate Azure Application Gateway WAF False Positive?
We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
- 228
2
votes
1
answer
88
views
Which CSP implementation is more secure?
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
- 189
0
votes
0
answers
76
views
How to protect a web app against supply chain attacks?
I'm looking for ways to further protect my web app against supply chain attacks.
Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
- 1
11
votes
3
answers
2k
views
Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe
If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
- 119
1
vote
0
answers
317
views
How to decode ysoserial .net payload
Is there any way to decode ysoserial .net payload?
For instance
I'm creating payload with:
ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity
Is there any ...
- 11
0
votes
3
answers
171
views
Security issues of exposing CRUD operations through a single API endpoint?
Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body.
{
"action":"[create|read|update|...
1
vote
0
answers
91
views
I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?
Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
- 111
0
votes
1
answer
155
views
Security for website admin panel [closed]
I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
- 101
0
votes
1
answer
120
views
What are the risks to an app in supporting older iOS versions?
I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user260465
3
votes
2
answers
783
views
Semicolon's relation with reverse proxy
What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache?
Like I've seen multiple times where people have ...
- 33
0
votes
1
answer
255
views
Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)
I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time.
I understand that both methods require to prove that the certificate (...
- 163
1
vote
2
answers
91
views
Securing APIs used by remote devices
We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
- 113
1
vote
1
answer
116
views
How do Services recognise 2-Factor Authentication codes as correct?
Something about the flow of setting up 2-factor authentication is not clear to me.
This is the flow of setting up a Service* to use a 2-factor auth app**:
Choose setup 2-factor auth in the account ...
- 13
1
vote
1
answer
86
views
Is an outdated library in a Windows user mode desktop application an actual security risk?
I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example:
This ...
- 1,247
1
vote
0
answers
156
views
Application Layer security vs Transport layer security [closed]
Application layer security or transport layer security which one is better?
TLS is convenient but application layer security will help to provide more security as this post explains
0
votes
1
answer
326
views
Python desktop application: storing cloud database passwords
I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3).
An issue arises ...
1
vote
0
answers
118
views
PII best practices
I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
- 111
0
votes
1
answer
323
views
Content-Length based DoS
I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
- 1
2
votes
1
answer
111
views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
- 21
0
votes
2
answers
554
views
JWT is being sent in cookies, but when I try for CSRF they are not sent
I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT.
I was under the ...
- 1
0
votes
0
answers
25
views
End-2-end encryption with WhatsApp [duplicate]
I have had recently gone through the horror of transferring WhatsApp conversations when changing phones (android for iPhone). Actually, the thing that it is close to impossible for everyday folk is a ...
- 125
0
votes
1
answer
88
views
Could a virus force a phone to download an app and spread it?
I'm writing a sci-fi story that includes a malicious app that spreads globally. The developer publishes an app without knowing it's infected, and it spreads because it forces phones to download it. ...
0
votes
3
answers
256
views
How to verify integrity of software when the download provider doesn't publish hashes?
I noticed that certain software does not provide hash anymore nowadays.
E.g.
Zoom
https://zoom.us/download
wolf@linux:~$ ls -lh zoom_amd64.deb
-rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
- 357
3
votes
2
answers
166
views
Are reproducible builds practically possible on major app stores?
'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it.
But numerous sources1,2 indicate reproducible builds are very ...
- 1,240
1
vote
1
answer
94
views
Become a Cloud Security analyst [closed]
What learning path would you recommend for someone interesting in focussing on the Cloud Security side and considering remote work in the future?
Many thanks
- 11
0
votes
0
answers
20
views
how to check if an app is safe [duplicate]
There is an app on Github
I was in a rush, so I didn't check, but there is no explanation or source code in its repo.
How could I check if it is not just sniffing my information or something?
Is there ...
- 101
0
votes
1
answer
183
views
Are weak entropy sources worth it?
I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
0
votes
0
answers
200
views
Exploiting Groovy RCE
I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
- 1
0
votes
0
answers
166
views
Repackaging Mobile app which resists repackaging
I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately.
This is the exception I am getting when I decompile this application using apktool and ...
0
votes
4
answers
704
views
Application is validating the file extension but not file content - Is this a security vulnerability?
An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
- 43