Questions tagged [appsec]
Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.
978
questions
3
votes
2
answers
383
views
Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?
I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
- 31
20
votes
3
answers
23k
views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
- 5,397
2
votes
2
answers
1k
views
Why should crossdomain.xml be present if user-uploaded files exist?
In his book Michal Zalewski says:
To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
- 5,397
51
votes
9
answers
6k
views
If I include a Forgot Password service, then what's the point of using a password?
I've implemented a Forgot Password service in the following way:
User goes to login page, clicks on "Forgot password?"
User is presented with a form that asks for their email address.
Email is sent ...
- 1,302
3
votes
2
answers
2k
views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
user1187
2
votes
4
answers
4k
views
Without using SSL, what's the most secure way to make an AJAX request to a PHP page?
It was suggested over at stackoverflow that I try my question here. This is it verbatim:
So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
- 47
4
votes
4
answers
469
views
What security standards should be implemented in a simple web application [closed]
I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
- 49
5
votes
3
answers
1k
views
What fraction of web sites are vulnerable?
It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
- 99.6k
2
votes
3
answers
2k
views
Securing dropdown boxes
I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured.
...
- 31
1
vote
3
answers
257
views
Smartphone SSH clients with shared user
I am writing an application for smartphones to provide very limited SSH usage. The user cannot perform arbitrary actions when logged in. They can run a specific script(s) only.
For various reasons ...
- 13
14
votes
2
answers
2k
views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
- 862
5
votes
0
answers
20k
views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
- 151
4
votes
2
answers
234
views
Changing windows client form values at runtime
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
- 1,603
1
vote
1
answer
1k
views
Web application software architecture: basic security
I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer.
Let's say I have three components of a web-...
Martin Lee
6
votes
3
answers
1k
views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
- 2,763
2
votes
2
answers
316
views
For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
- 50.9k
40
votes
1
answer
8k
views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
- 50.9k
6
votes
7
answers
20k
views
Reverse engineering (decompiling) an hackme challenge .exe file in OSX
I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain.
Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
- 323
13
votes
4
answers
691
views
Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?
Background
We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
- 255
5
votes
2
answers
2k
views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
- 267
10
votes
2
answers
14k
views
How to store IV and key temporarily but securely
I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
- 203
7
votes
3
answers
415
views
Should I store my intellectual property / code online?
As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much more....
- 173
7
votes
2
answers
539
views
What to consider when generating random code as part of two-factor authentication?
I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
- 171
4
votes
2
answers
2k
views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
- 549
2
votes
1
answer
517
views
Tomcat IP restriction vs Two Legged OAuth
We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
user1219578
0
votes
1
answer
128
views
Is there a grading standard for security that I can apply to my MVC3 web site?
I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list ...
ProfK
22
votes
4
answers
14k
views
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Let's say I develop an application that,
Allows any user to upload a file of only white listed mime content type and extensions (word and pdf).
Serves those files with the allowed extension and ...
- 535
10
votes
2
answers
4k
views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
- 535
5
votes
4
answers
11k
views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
- 2,585
5
votes
1
answer
1k
views
question for pentesters: PHP proc_open() in safe_mode
Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?
As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
- 71
10
votes
2
answers
1k
views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
- 5,397
11
votes
2
answers
16k
views
Benefits to Arch Linux over Kali Linux
What are the relative benefits of BlackArch or other Arch-based distro over Kali?
Are the tools broadly the same, or does one have better functionality in a particular area?
Are there any other pen-...
- 19.1k
10
votes
4
answers
7k
views
How to harden an iPhone/Android app so it's tough to reverse-engineer it?
These are the following objectives I have in mind:
Make the app hard to crack, as the binary will hold some secret tokens.
If it still can be cracked, is there any way the app can tell someone or its ...
- 211
1
vote
5
answers
259
views
How to replace a constant identifier, for a resource on a network, with a variable one?
I guess the example can make it easier.
Assume each Client on a network has an identifier(some alphanumeric sequence) which identifies it uniquely on the network. Each time the Client corresponds ...
- 211
0
votes
1
answer
2k
views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
- 321
2
votes
1
answer
435
views
Is 90 day expiration for unique URL too long?
A web application I've been developing has a new use case that has me searching for something easier than username/password authentication.
Current users don't sign up for the service themselves ...
- 163
3
votes
4
answers
5k
views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
- 2,585
1
vote
1
answer
143
views
Are user-provided translation strings an attack vector
Twitter and various other web companies allow users to help translate the user interface into their language.
Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on ...
- 3,893
1
vote
2
answers
2k
views
anti-CSRF tokens vs Referer and POST testing
I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that ...
- 14k
0
votes
1
answer
527
views
Business systems development (.NET, Java) vs IT Security Field, salary/future perspective
What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java?
Which path should one ...
- 135
1
vote
1
answer
1k
views
Windows Session Recording Software
I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying).
I've heard about a software which can record a video of any ...
- 41
10
votes
3
answers
2k
views
Are there any established secure coding guidelines available for mobile devices?
I am looking for secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5.
Would it be a good approach to use a "...
- 7,455
3
votes
2
answers
1k
views
Security while connecting to a MySQL database using PDO
I looked at this question: What is the right way of storing database connection strings from the security point of view?
And I'm wondering specifically for connecting to a MySQL database with PDO, ...
- 145
2
votes
2
answers
245
views
hardware required for wifi security system
i am planning to implement one WIFI security system , in which one can lock or unlock door remotely.
As i have serched over internet and i came across
lockitron and schlage
Now what i want to know ...
- 121
11
votes
2
answers
261
views
Should I prevent user from operating with site during some first seconds?
Imagine the following scenario: User is at attacker.com and plays a game there. Just before he clicks at some point he is rerouted to victim.com using browser's history. User thought that he clicked ...
- 5,397
18
votes
1
answer
6k
views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
- 361
8
votes
2
answers
3k
views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
- 181
4
votes
3
answers
315
views
Should user input be validated for it's length?
Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other?
I think it depends on programming language of ...
- 5,397
7
votes
3
answers
382
views
How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?
Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source ...
- 837
6
votes
2
answers
3k
views
Where can I find exploit code?
I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are:
CVE-2010-...
- 393