Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

What are the types of vulnerabilities that could result in exploits that do not require user interaction? [closed]

What are the existing types of vulnerabilities that could result in exploits that do not require user interaction (e.g. zero-click)? I'm trying to understand the type of zero-click attack type for us ...
0
votes
0answers
25 views

What controls should we put in our code to protect our application from zero click attacks? [closed]

What controls should we put in our code to protect our application from zero-click attacks?
5
votes
1answer
101 views

What are the general security implications behind using a web app vs its equivalent desktop app?

In 2020, there are a lot of applications which have a web interface as well as "desktop apps." Such applications are either the same in functionality or very close. Three examples of this situation ...
0
votes
1answer
28 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
62
votes
3answers
6k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
0
votes
2answers
72 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
0
votes
0answers
39 views

How does iOS device management work?

Under Settings -> Device Management I notice there are at least 3 different categories of items: Mobile Device Management Configuration Profile Enterprise App But documentation online seems sparse ...
2
votes
1answer
71 views

Is using the JWT token to perform queries, as opposed to a raw value in its payload, considered a good practice?

For my SPA app, I'm using Firebase as the authentication provider. I'm also using this token to authenticate with my back-end server. The Firebase documentation reads: "Warning: Do not accept ...
0
votes
0answers
28 views

how this default Session ID can be malicious or cause unintended results in application

I was looking the docs on what damages can be done by hackers if default Session ID is revealed in web application.
0
votes
1answer
60 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
7
votes
2answers
2k views

Is it safe to send sensitive data in the post body to an azure function?

We want our users to send us a post request to an Azure Function endpoint. Is storing sensitive data (such as connectionstrings or passwords) in the post request body going to be an issue? Any insight ...
1
vote
1answer
87 views

Concealing method results

I have to maintain a java application with security code I am not sure is really useful and the original purpose is not clear (and the original developer is long gone). Basically, the code will check ...
0
votes
0answers
36 views

API security multi step vulnerabilities

Anyone know of a good fast way to detect multi step vulnerabilities? For example x endpoint is a dumb post and returns success. Y endpoint gets the request that was submitted in x.
0
votes
1answer
99 views

EIP pointing to shellcode but shellcode is not executing?

I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
0
votes
0answers
142 views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
0
votes
0answers
35 views

JWT in GraphQL GET Request via AJAX

I have a SPA (Single Page Application) that receives and updates information about the logged in user from the API using an AJAX request. However, the requests are authorized using a JWT (JSON Web ...
1
vote
1answer
52 views

What is the ideal technique to protect unauthorized redirects

I'm looking for the best way to secure unauthorized redirects from GET parameter where url=http://example.com I'm thinking about creating an unique identifier like using a hashing function (md5 for ...
1
vote
2answers
95 views

Anything wrong with using IMAP as authentication for a web app to achieve a kind of easy SSO?

The idea would be to wrap a server-side IMAP client in a wrapper that transforms IMAP authentication into a web API for authentication (maybe OAuth?). When the back-end application receives ...
1
vote
1answer
78 views

If an application has an XSS vulnerabilty, can we bypass CSRF with referer header?

Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating ...
29
votes
6answers
7k views

Poor error handling source code review

I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions: 1) Poor Error Handling: Overly Broad Throws The methods in program1....
0
votes
0answers
41 views

Securing application on windows 10

I need to figure out how to run my application on Windows 10. My application would run on an app-specific account (let's called it "App"). My application saves/reads PDFs from the folder "PDF". I ...
2
votes
1answer
55 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
3
votes
2answers
110 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
3
votes
1answer
252 views

Is SQL Injection possible in this case (REGEXP)?

I'm on a website which have a program, there is a search input for keywords. When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
34
votes
9answers
9k views

Security implication if android app can be installed on emulator

I am working on ensuring security of my company's product. We have a mobile version of the product. This question is for the Android version Background - Our product is a SaaS-based product and the ...
1
vote
1answer
457 views

What Data Does an ISP Store? [closed]

Sorry for being so general, but I know my ISP logs connections to others and all. I'm just questioning whether they keep any physical data that was over a HTTPS connection. Learned about how ISPs also ...
0
votes
0answers
42 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
1
vote
0answers
86 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
0
votes
2answers
94 views

Can a bug in an application that has no internet connection be used from outside

I have recently been occupied with a question regarding IT security. Suppose there is an application on a PC that is connected to the Internet, but it does not have access to the Internet or support ...
3
votes
2answers
460 views

How good are Angular Route Guards from a security standpoint?

For an enterprise setting, how secure are Route Guards against script kiddies, hackers, and advanced threats? If I understand correctly, the route guards are all available in .js files to the ...
0
votes
2answers
338 views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
1
vote
3answers
640 views

Can Burp be setup to intercept traffic from client application?

I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic. I understand that Burp can do the MITM for web application, but ...
1
vote
2answers
235 views

Is Objective C (really) affected by buffer overflows?

I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style"). I understand that Objective-C is based on C, but are there any ...
1
vote
1answer
145 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
0
votes
0answers
36 views

Securing user secrets in KeyChain vs Keychain+Biometrics

The common approach to secure user secrets in native applications seems to be storing the secret in keychain and adding an additional layer of protection by way of biometrics/touchId/FaceID. My ...
0
votes
1answer
79 views

How to Perform a Security Review of Apps from Mac App Store

As part of our software procurement process, we're evaluating the security of applications, e.g. by checking if there are non-addressed vulnerability reports and if the vendor embedded secure ...
0
votes
1answer
49 views

Should I consider naming my AMQP queues randomly?

I'm using rabbit-mq as the main communication method in my microservices. The names of each queue describe exactly what is the purpose of it. e.g "send-payment", "send-email" and so on. Should I ...
0
votes
2answers
636 views

Intercepting Android 9 app-traffic

I used MitMproxy until recently I switched from the Samsung Galaxy S5 to the S9+ which runs Android 9... and suddenly I can't intercept apptraffic anymore. Looks like the proxy in the wifi-settings is ...
1
vote
0answers
42 views

Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?

Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server. Is there a possible way for an ...
0
votes
0answers
45 views

Pre-flight request is triggering in Chrome but not in IE

I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
1
vote
0answers
94 views

Safely Display Card PIN

We are currently sending the card PIN via SMS. We do not store them in any way, neither do we have the possibility to change it. The only way to change it is for the customer to go to an ATM and ...
0
votes
1answer
90 views

How to check vulnerable component and its version in any APK?

I have given an app to test, on which I ran a quick scan in composition tool like Protecode, It shows all component (like okhttp, protobuf,okhttp etc.) used and existing vulnerability. My question is,...
1
vote
1answer
185 views

Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?

Just like the title says, I would like to understand: what are the implications of running a custom app (like node or flask) on port 80/443. Is running a reverse proxy like Nginx mandatory from a ...
0
votes
0answers
30 views

AMSI scanning for domain specific languages

Should an application on Windows that has a DSL (domain specific language, scripting interpreter in this case) pass those scripts to AMSI for scanning, or should we restrict ourselves to more known ...
1
vote
1answer
323 views

data:// uri XSS - using wrappers

Is there any way to load html data uri: data:text/html,<html><svg/onload=confirm(1)></html> with this scheme: data:// i have seen this payload going around: data://text/javascript,...
2
votes
1answer
108 views

Can you exploit an application that imports a vulnerable library, but does not actually use the classes from the library?

Suppose you have vulnerable library, vuln-lib.jar, that you then import into your source code but never actually use: #My imports import com.vuln.lib.* #My code .. And you go onto to deploy this ...
1
vote
1answer
319 views

Is anything missing in the offline software licensing plan?

I'm working on a piece of software written in VB.NET for Windows machines (mainly Windows Server). I have some understanding of cryptography and security, but I want some good old fashioned peer ...
0
votes
0answers
84 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
0
votes
0answers
226 views

Cycript (Killed: 9 error) on jailbroken ios 11.4

I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console. Searching online ...
0
votes
2answers
474 views

What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)

What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault) Whenever I've ...

1
2 3 4 5
19