Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
211
votes
7answers
79k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
0
votes
1answer
39 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
1
vote
1answer
636 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
1
vote
2answers
44 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
5
votes
1answer
671 views

Alternative to client certificate authentication with HTTP/2

We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2. We are investigating ...
1
vote
1answer
57 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
2
votes
1answer
49 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
103 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
1
vote
1answer
42 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
1
vote
0answers
47 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
1
vote
1answer
118 views

Concealing method results

I have to maintain a java application with security code I am not sure is really useful and the original purpose is not clear (and the original developer is long gone). Basically, the code will check ...
0
votes
2answers
52 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
0
votes
1answer
58 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
0
votes
1answer
34 views

Content-Length based DoS

I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the ...
3
votes
3answers
2k views

Added security risks that come with 3-tier software architecture

Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project? I got asked this today, and my gut reaction was "I don't see why there would be." ...
1
vote
0answers
47 views

PII best practices

I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
19
votes
4answers
11k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
5
votes
1answer
751 views

Online Diffe-Hellman Tool

So I stumbled upon this website which provides a service to generate Diffe-Hellman paramaters online for free to the public. Surely using a website like this would be a bad idea to use in a ...
46
votes
4answers
12k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
6
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate solution (...
1
vote
1answer
102 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
1
vote
1answer
187 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
110
votes
9answers
79k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
16
votes
3answers
915 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
6
votes
7answers
18k views

Reverse engineering (decompiling) an hackme challenge .exe file in OSX

I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
0
votes
0answers
18 views

End-2-end encryption with WhatsApp [duplicate]

I have had recently gone through the horror of transferring WhatsApp conversations when changing phones (android for iPhone). Actually, the thing that it is close to impossible for everyday folk is a ...
3
votes
2answers
146 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
5
votes
2answers
3k views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
0
votes
1answer
45 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
0
votes
1answer
53 views

Could a virus force a phone to download an app and spread it?

I'm writing a sci-fi story that includes a malicious app that spreads globally. The developer publishes an app without knowing it's infected, and it spreads because it forces phones to download it. ...
0
votes
3answers
105 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
29
votes
6answers
8k views

Poor error handling source code review

I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions: 1) Poor Error Handling: Overly Broad Throws The methods in program1....
1
vote
1answer
57 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
6
votes
2answers
26k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
10
votes
5answers
3k views

Protect application from being modified

I have a question about how to detect a program/binary modification assuming the program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but ...
0
votes
1answer
130 views

Are rich-client apps inherently more secure than webapps? [closed]

If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF ...
29
votes
7answers
8k views

What are some good website security scanning solutions? [closed]

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
1
vote
1answer
44 views

Become a Cloud Security analyst [closed]

What learning path would you recommend for someone interesting in focussing on the Cloud Security side and considering remote work in the future? Many thanks
0
votes
0answers
16 views

how to check if an app is safe [duplicate]

There is an app on Github I was in a rush, so I didn't check, but there is no explanation or source code in its repo. How could I check if it is not just sniffing my information or something? Is there ...
0
votes
1answer
82 views

Are weak entropy sources worth it?

I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
0
votes
0answers
71 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
0
votes
0answers
86 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
0
votes
4answers
112 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
0
votes
1answer
61 views

Protecting my machine from running untrusted applications

I was big fan of the Toontown Online MMO when Disney used to run it so I was excited to learn that it had been revived by a fan or group for fans building on the original source code. During a recent ...
1
vote
0answers
260 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
45
votes
8answers
8k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
0
votes
0answers
155 views

How to verify public key?

If you live in a jurisdiction where the public key server cannot be trusted (some countries in the world), the only way to authenticate the public is to compare the public key you received with the ...
66
votes
3answers
135k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
0
votes
1answer
74 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...

1
2 3 4 5
19