Questions tagged [appsec]

Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.

60 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
3
votes
2answers
208 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
3
votes
0answers
87 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
2
votes
1answer
92 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
2
votes
0answers
187 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
2
votes
0answers
785 views

How apps manage to prevent bypassing SSL pinning using Xposed framework?

We all know how to bypass SSL pinning using Xposed Framework module - SSLUnpinning. But I've found apps which cannot be bypassed this way. How do these apps prevent bypass of the SSL pinning which is ...
2
votes
0answers
553 views

Testing thick client application over citrix

I am looking for a checklist or methodologies which can be adopted to test a thick client application over citrix environment. Owasp has listed some top 10 issues to look for in a thick client but as ...
2
votes
0answers
254 views

Is it possible to use Burp to show hidden AngularJS elements, that are hidden using "ngHide"?

I’m performing an audit of an AngularJS application that uses Angular's ngShow and ngHide to show and hide elements on a page. Is it possible to use Burp Proxy, Burp Macros, or another tool to ...
2
votes
0answers
1k views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
2
votes
0answers
191 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
0answers
502 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
1
vote
0answers
97 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
1
vote
0answers
80 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
1
vote
0answers
83 views

PII best practices

I'm looking for some guidance and advice on data security best practices, specifically on how to best separate, store and secure personal identifiable information from other data. The background is ...
1
vote
0answers
368 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
1
vote
1answer
165 views

Concealing method results

I have to maintain a java application with security code I am not sure is really useful and the original purpose is not clear (and the original developer is long gone). Basically, the code will check ...
1
vote
0answers
683 views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
1
vote
0answers
85 views

Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?

Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server. Is there a possible way for an ...
1
vote
0answers
130 views

Safely Display Card PIN

We are currently sending the card PIN via SMS. We do not store them in any way, neither do we have the possibility to change it. The only way to change it is for the customer to go to an ATM and ...
1
vote
0answers
161 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
1
vote
0answers
457 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
0answers
77 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
0answers
196 views

Do WebEx's requirements open security holes?

After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites: ...
1
vote
0answers
135 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
1
vote
0answers
103 views

Does using a widget tool like GetSiteControl or HelloBar create a security risk?

There are 3rd party tools to insert widgets into a website. By inserting a snippet of Javascript tools like HelloBar and GetSiteControl allow users to easily create popups, toolbars, and chat windows. ...
1
vote
0answers
112 views

Minimizing high risk obsolete application entry points

I am working on a .NET MVC based project involving an application with over 50,000 unique entry points. Using our own custom static code analysis built using the .NET reflection libraries we have ...
1
vote
0answers
71 views

How can I perform DAST on protocols other than HTTP/HTTPS

How can I perform DAST on protocols other than HTTP/HTTPS in case of a web application which does not have an URL but communicates with many other systems to pull or push data.
1
vote
0answers
116 views

For a web application which employs application layer encryption, is there anyway to modify post parameters which is captured encrypted in burp.?

There is client side javascript controls in place which restricts malicious characters. All form data is transmitted via POST requests. In burp, I can see that all parameters are encrypted into one ...
1
vote
0answers
111 views

How to share data securely between two Windows applications, not running at the same time?

Scenario: Let's say I'm on a Windows machine. I have a data-driven uninstaller application that knows how to uninstall/remove various types of things (apps, files, etc...). Requirements: Rather ...
1
vote
0answers
593 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
1
vote
0answers
80 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
1
vote
0answers
68 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
1
vote
0answers
1k views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
1
vote
0answers
2k views

How do I view the signature of an iOS application?

OSX had an issue where the certificate was expired and several apps could not be opened after that date. The command above illustrates how this could have been detected. Does iOS have a similar ...
1
vote
0answers
82 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
1
vote
0answers
335 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
98 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
58 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
62 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
1
vote
0answers
176 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
21 views
+50

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
0
votes
0answers
24 views

How do you connect a piece of code in a repo to an actual user-input point in an app?

This is conceptual I know so let me know if there's a better place to ask this. I'm wondering how people can view a piece of code in a repo they aren't familiar with, or simply didn't write, and ...
0
votes
0answers
20 views

Local attack vector and other metrics

While calculating the CVSS score using CVSS3.1, attack vectors are classified into four. Network - Remote attack Adjacent - Should share the same Physical or Logical network of victim Physical - ...
0
votes
0answers
58 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
0
votes
0answers
105 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
0
votes
0answers
142 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
0
votes
1answer
98 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
0
votes
1answer
163 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
0
votes
0answers
66 views

Securing application on windows 10

I need to figure out how to run my application on Windows 10. My application would run on an app-specific account (let's called it "App"). My application saves/reads PDFs from the folder "PDF". I ...
0
votes
0answers
70 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...