Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.5k
0 votes
1 answer
37 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9
1 vote
0 answers
73 views

Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?

I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
Ron's user avatar
  • 111
2 votes
2 answers
78 views

Standards for Secure Products

I am interested in standardizations for secure design and development of products, especially towards operational technology / IoT / ICS. My understanding of information security management systems ...
Nesuma's user avatar
  • 71
1 vote
0 answers
49 views

Learning Desktop Application Security

I am familiar with web security but I would like to know more about non-web application security. I know about memory corruption vulnerabilities like buffer overflow and buffer overread and how ...
Frixos Kallenos's user avatar
0 votes
0 answers
71 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
1 vote
1 answer
278 views

Burp DOM-based Open Redirect

When I sent a request such as: GET /500.aspx?aspxerrorpath=/error.aspx HTTP/1.1 Host: test.com Burp reports "The application may be vulnerable to DOM-based open redirection: Data is read from ...
TSFH's user avatar
  • 13
-1 votes
2 answers
239 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
2 votes
0 answers
116 views

Authorization and permissions in backend

My Dev team creates high-load applications and wants to use Keycloak with OpenID authz. But they are complaining about delays for retrieving permissions from Authz server (Keycloak). So, they decided ...
Vlad's user avatar
  • 33
0 votes
1 answer
113 views

Which kind of data breaches or risk can happen if there is no virtual/physical disk encryption

There is an Azure-based internal database server and is not public-facing. There is another front-end application. A specific user group can connect with a VPN. There is no encryption applied at the ...
steavesec07's user avatar
1 vote
0 answers
77 views

Is it okay to have exposed Google API key [duplicate]

After running MobSF static analysis on an application, the scan detected google_api_key as a possible hardcoded secret. Should Google API keys be encrypted ? Or is it okay to have them exposed if you ...
ShakyFingerGuns's user avatar
0 votes
2 answers
122 views

As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?

From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
Sir Muffington's user avatar
0 votes
1 answer
101 views

What security reviews are done on apps in mobile app stores? [closed]

What checks (static analysis, dynamic analysis etc.) does Google, Apple, Amazon etc. do on their app stores with each app developer submit? Are they automatic or manual? Does any app store review ...
maskin's user avatar
  • 129
3 votes
1 answer
166 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
SERO9's user avatar
  • 31
1 vote
1 answer
57 views

Is switching my C/C++ compiler for security testing generally reliable?

If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
the_endian's user avatar
  • 1,149
1 vote
1 answer
211 views

How does a non technical user/beginner vet Android apps to ensure they are safe?

Background I moved from ios to Android so now can't rely on Apple doing some checks on the apps. I was told that Google does some automated checks and if you buy/download apps from large organisations,...
maskin's user avatar
  • 129
2 votes
5 answers
2k views

Session regeneration after password change?

So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
A J's user avatar
  • 21
1 vote
1 answer
183 views

What is the significance of an app leaking its access token - knowingly/unknowingly with just read access

I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
Supraja's user avatar
  • 23
1 vote
1 answer
90 views

Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?

For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
galadriel34's user avatar
1 vote
1 answer
157 views

Vulnerabilities in Build-time Libraries Could be a Security Threat

If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
Mjina's user avatar
  • 111
1 vote
1 answer
306 views

How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?

There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE". ...
Shakalakah's user avatar
3 votes
0 answers
229 views

Securely store application secrets in production without 3rd party KMS

Integrated Security I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
JCasper's user avatar
  • 31
1 vote
3 answers
149 views

Why don't applications suggest passwords themselves?

Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
prmph's user avatar
  • 227
0 votes
1 answer
206 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
JavaForAndroid's user avatar
0 votes
1 answer
78 views

Does the IDOR vulnerability have to be sensitive data?

I had a hard time convincing a bug I reported that it was a bug bounty program. It seems to be more of a discussion than a question. Scenario: Users shop on the shopping site. The categories of these ...
r1z4x's user avatar
  • 3
0 votes
0 answers
94 views

Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?

This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
Skaman Sam's user avatar
0 votes
1 answer
62 views

Static react native app security issues

I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
server_unknown's user avatar
1 vote
1 answer
64 views

Vulnerability: Standalone Library vs. Same Code Elsewhere

Are libraries inherently more vulnerable than in-house application code? The speaker of this talk generally advises folks against creating wrapper libraries for Erlang in Elixir rather than just ...
stk1234's user avatar
  • 202
1 vote
0 answers
142 views

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
Amir Ashar's user avatar
1 vote
1 answer
644 views

Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?

I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
Testers Logic's user avatar
1 vote
1 answer
1k views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
Pranav Jituri's user avatar
2 votes
1 answer
119 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
Joel Deleep's user avatar
0 votes
0 answers
89 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
floflo's user avatar
  • 1
11 votes
3 answers
3k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
Danny Palma's user avatar
1 vote
0 answers
444 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
K P's user avatar
  • 11
0 votes
3 answers
235 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
discordia28's user avatar
1 vote
0 answers
101 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
SpaceCowboy74's user avatar
0 votes
1 answer
201 views

Security for website admin panel [closed]

I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
AD-1's user avatar
  • 101
0 votes
1 answer
137 views

What are the risks to an app in supporting older iOS versions?

I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user avatar
3 votes
2 answers
1k views

Semicolon's relation with reverse proxy

What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache? Like I've seen multiple times where people have ...
James's user avatar
  • 33
0 votes
1 answer
372 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
user2530062's user avatar
1 vote
2 answers
100 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
Sen's user avatar
  • 113
1 vote
1 answer
139 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
curiousByte's user avatar
1 vote
1 answer
95 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
Martin's user avatar
  • 1,247
1 vote
0 answers
210 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
Sivaram Rasathurai's user avatar
0 votes
1 answer
391 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
Georgiy Santonov's user avatar
1 vote
0 answers
146 views

PII best practices

I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
DrGonzoX's user avatar
  • 111
1 vote
1 answer
642 views

Content-Length based DoS

I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
Subbu's user avatar
  • 11
2 votes
1 answer
144 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
displayme's user avatar
1 vote
2 answers
856 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
John's user avatar
  • 11

1
2 3 4 5
20