Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

0
votes
0answers
10 views

Assessing 3rd party/COTS desktop applications (Newbie question)

How common is it to assess desktop applications for security before adding them to a company portfolio? My employer has a growing portfolio of desktop applications bought from a wide range of vendors,...
7
votes
1answer
158 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
1
vote
0answers
56 views

Do WebEx's requirements open security holes?

After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites: ...
2
votes
0answers
24 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
0
votes
1answer
94 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
0
votes
0answers
22 views

How would attackers bypass Token Binding?

Token binding is not easy to implements across organizations to support Bearer Tokens. The problem with Bearer Token is that merely having it even if it was stolen will be enough to use (same idea as ...
1
vote
1answer
56 views

Can someone highlight the key difference between CRLF Injection, HTTP Response Splitting and HTTP Header Injection?

I believe each one of these is closely interlinked, for instance, HTTP Response Splitting will occur in event of CRLF characters injection (%0d%0a) and this will also involve injection of HTTP headers ...
0
votes
0answers
54 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
0
votes
0answers
37 views

When developing a web application why should I enable case sensitivity for routes and strict routing mode?

Example for enabling case sensitivity will be for example "/show" route is not the same as "/Show". What are the best security best practice will be here? I was also wondering if I should enable ...
0
votes
3answers
106 views

Should I block a user from using banking app if they fake the location?

I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
1answer
39 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
1answer
83 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
1
vote
2answers
57 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
4
votes
3answers
383 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
0
votes
0answers
26 views

Suggestion for intercepting traffic with android app [duplicate]

Are there any tools that I can use to intercept the traffic of android app? I tried Charles proxy and Burp suite but they only support HTTP/HTTPS traffic. I have to pentest a game, basically it's ...
0
votes
1answer
150 views

XSS payload without html tags [duplicate]

Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.
0
votes
0answers
25 views

JSP example scripts residing on the server

On one of the web applications I am checking, running a nikto scan revealed the following 'examples' folder in the web-root with the following contents. While I will definitely suggest to remove them, ...
0
votes
1answer
36 views

Applying regexp for user input validation using JavaScript

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
5
votes
1answer
103 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
2
votes
1answer
55 views

Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp. However, this app has an oAuth token ...
0
votes
1answer
47 views

Can a secure invitation link be sent client-side only?

One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with ...
3
votes
0answers
76 views

String Serialization in .NET [closed]

I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET ...
2
votes
1answer
67 views

Alternative to client certificate authentication with HTTP/2

We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2. We are investigating ...
0
votes
0answers
19 views

Protecting API - Using 3rd party? or Application Firewall? [duplicate]

Our company has a mobile app with a lot of traffic and we want to protect its API. How can we reduce brute force attacks? Does account lockout is the fastest and proper way to achieve protection? We ...
4
votes
3answers
224 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...
4
votes
2answers
129 views

Can results from DAST (Dynamic Application Security Testing) tools be false positive?

I know results from Static Application Security Testing (SAST) can be false positives or real and it is up to the security analyst and developer to decide which vulnerability is real based on the ...
2
votes
1answer
72 views

What is the relationship between HTTP response codes and successful execution of XSS attacks?

What is the relationship between HTTP response codes and successful execution of XSS attacks? For e.g I am using a commercial vulnerability scanner that reports XSS vulnerability found in a certain ...
0
votes
1answer
498 views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
1
vote
0answers
44 views

Review: Security model for sync service [closed]

I am working on a sync service for my desktop app. The app tracks (with the user's consent) some computer usage data (comparable in terms of sensitivity to their browser history), so I'd like for this ...
4
votes
1answer
165 views

Inspecting code elements in browser when logging in

When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
-5
votes
1answer
110 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
0answers
23 views

Can I perform a basic web application security test of a web application from a pcap file

I have been trying to run zed attack proxy against a web application using some automated functional tests. ZAP keeps failing at some point due to sslsocket exceptions (I think due to making requests ...
3
votes
2answers
71 views

Turing-completeness impact on system security

I always find in many papers discussing different kind of system security subject that the authors always trying to highlight the danger of some vulnerabilities by assuming an attacker, by exploiting ...
5
votes
1answer
252 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
4
votes
1answer
101 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
0
votes
1answer
101 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
0
votes
1answer
330 views

How to prevent users from retrieving the Java source code from a jar/exe file that I am distributing openly? [duplicate]

I guess Java jar files can be reversed back to the source code and I want to prevent it from happening that easily. What I did was to convert the jar file into a Windows native exe file using launch4j....
1
vote
1answer
100 views

Application and Information Security software development market [closed]

This is a question more about how the market is for a software engineer with a focus on application and information security, mainly development and software engineering, either of secure practices ...
1
vote
2answers
199 views

Storing certificate bundles (.pfx files)

In an application deployed across multiple environments (e.g. Test/Prod), what's a good practice for storing the environment specific certificate bundle (.pfx file)? Is password protecting the .pfx ...
3
votes
2answers
118 views

AppSec Developer Certifications

I've noticed that certifications seem to be a big part of the IT Security Professional (non-development), but have not seen the same attention being given/required of the software development engineer ...
5
votes
5answers
264 views

Should I remove bash from my Docker web app container?

Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
0
votes
3answers
179 views

Is “Please update/confirm your email address” actually helpful?

Steam just asked me "Is this still your email address? [email_address_here]" This is an on-PC app that I trust, so I'm 100% confident of its legitimacy. I would like to know about its usefulness. ...
4
votes
2answers
371 views

Can a security job be cracked without OSCP?

I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any ...
0
votes
0answers
44 views

Securing hotspot with maintaining Deep packet İnspection

Recently I have heard about a project about developing firewalls on mobile hotspot devices (Mobile application/android as a start) These firewalls have the control from all levels of network (since ...
0
votes
0answers
118 views

APKTool: Issue in Rebuilding Android Application Built on Android Oreo

During the security assessment of the Android applications. I check if the application is tamper proof. For this, I decompile the application using apktool and then tamper it by modifying the ...
3
votes
1answer
78 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
0
votes
0answers
63 views

can I use openssl to generate a 160-bit ECC certificate

I am doing some testing of the new security settings coming out in the next set of java patches. One of the new restrictions is to not allow ECC keysizes less than 224 bits. I want to generate an ECC ...
3
votes
0answers
436 views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
4
votes
1answer
93 views

Vulnerability in restricted eval

Is it possible to exploit this code? eval ("\$RequestVariables = \$_REQUEST;"); or eval ("\$ServerVariables = \$_SERVER;"); I know if $_REQUEST or $_SERVER wasn't an array and if it was a string ...
2
votes
2answers
309 views

How is app repackaging attack possible if I only download from Google's play store?

Assuming I always download all my apps from official google's app store, how can I still be a victim of a malicious app that was repackaged? or in other terms is app repackaging attack possible via ...