Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
861
votes
13answers
259k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
201
votes
5answers
72k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
90
votes
4answers
17k views

How does XSS work? [closed]

I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
97
votes
8answers
13k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I can'...
41
votes
4answers
11k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
38
votes
1answer
6k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
35
votes
2answers
7k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
18
votes
4answers
9k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
17
votes
3answers
6k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
76
votes
19answers
6k views

What security resources should a white-hat *developer* follow these days? [closed]

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that tracks ...
23
votes
3answers
6k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
62
votes
3answers
122k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
32
votes
5answers
14k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
63
votes
16answers
56k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
58
votes
6answers
22k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
48
votes
8answers
4k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
48
votes
4answers
118k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
19
votes
3answers
21k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
34
votes
5answers
40k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
24
votes
7answers
17k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
11
votes
6answers
9k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
9
votes
2answers
4k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
78
votes
7answers
49k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
24
votes
2answers
10k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
103
votes
5answers
17k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
16
votes
4answers
7k views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app traffic....
16
votes
3answers
8k views

Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?

Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions. Ref: http://...
27
votes
3answers
5k views

Should I have a maximum password length?

I'm creating a webapp, and part of my authentication method is password length. Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6). Are there ...
17
votes
3answers
5k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
82
votes
2answers
40k views

Should I use AntiForgeryToken in all forms, even login and registration?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
57
votes
5answers
54k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they don'...
21
votes
6answers
11k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
24
votes
8answers
3k views

How to protect against brute forcing

How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
23
votes
14answers
4k views

How can you become a competent web application security expert without breaking the law?

This question was asked here on Programmers Exchange, but it was suggested I ask here as well since most of the experts would likely hang out on IT Security exchange instead. I find this to be ...
18
votes
5answers
20k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
16
votes
4answers
867 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
7
votes
2answers
17k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
14
votes
6answers
5k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...
10
votes
5answers
2k views

Protect application from being modified

I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
11
votes
2answers
674 views

What is considered the simplest (or lightest) secure development lifecycle?

Microsoft has there simplified SDL: "The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development." "The process outlined in this paper sets ...
50
votes
5answers
10k views

New XSS cheatsheet? [closed]

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
44
votes
5answers
10k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
15
votes
13answers
66k views

How can I intercept and modify HTTP requests?

Are there any free tools available that let me intercept and modify HTTP requests for testing? I am looking for tools which allow me to send custom HTTP headers.
62
votes
3answers
6k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
46
votes
2answers
10k views

How do I use Markdown securely?

How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page? I want to allow untrusted users to enter content (in Markdown format)....
6
votes
2answers
1k views

Beginners materials for web security [duplicate]

Possible Duplicate: Resources to learn about security What materials can I study to learn web development security. I'm a web developer, I use ASP.NET, Java, PHP, and JavaScript. I want to learn ...
17
votes
2answers
3k views

Storing sensitive information securely

I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
17
votes
7answers
4k views

Best practises for preventing SQL injection?

SQL injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL injection within any web ...
22
votes
3answers
6k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
18
votes
4answers
2k views

Web Security Cheatsheet / ToDo list

Can anyone suggest a cheatsheet or ToDo list of web site and application security? A local small business owner prompted a question about web security, basically her company website just got XSS ...

1
2 3 4 5