Questions tagged [appsec]
Application security - Specific to security concerns for an application that are independent from the underlying operating system, or surrounding infrastructure. Pertains to the design / architecture, source code, patching and maintenance cycle, or deployment and configuration of this software.
969
questions
6
votes
1
answer
1k
views
Online Diffie-Hellman Tool
I stumbled upon this website which provides a service to generate Diffie-Hellman parameters online for free to the public.
Surely using a website like this would be a bad idea to use in a production ...
- 213
-5
votes
2
answers
136
views
What is the most crypto-resistive algorithm to safely send information? [closed]
What algorithm is the best to use for storing, sending passwords, account data, and other information between desktop apps over the network.
Looking for the best crypto-resistive algorithm to use in ...
6
votes
3
answers
1k
views
How to handle personally identifiable information (PII) as a startup?
My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What ...
- 61
1
vote
2
answers
671
views
Direct Access to Administration Pages ,The web server or application server are configured in an insecure way
Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody ...
- 11
1
vote
0
answers
142
views
What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?
What type of vulnerabilities would be found additional in a source code review vs a pentest?
If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
- 11
1
vote
1
answer
228
views
Rate limiting in mobile application
We have implemented in our mobile application a rate limiting access after 5 failed attempts though a web based services (API).
We lock down the account for 30 mins if the fives attempts have been ...
- 655
2
votes
2
answers
400
views
How to address application database compromise
I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really ...
- 21
0
votes
2
answers
5k
views
Directory traversal in a URL?
Scenario:
I have a webserver running nginx. I have my HTML files in /var/www/ and pictures in /var/www/pictures/.
However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
- 103
0
votes
1
answer
307
views
HTTP Security header implementation
Does any one know if:
X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy
are for HTTP and:
Strict-Transport-Security
Public-Key-Pins
are for HTTPS?
What I mean is ...
- 493
3
votes
0
answers
99
views
How do I obtain linux user authentication information securely?
For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
- 31
1
vote
0
answers
118
views
Does using a widget tool like GetSiteControl or HelloBar create a security risk?
There are 3rd party tools to insert widgets into a website. By inserting a snippet of Javascript tools like HelloBar and GetSiteControl allow users to easily create popups, toolbars, and chat windows.
...
- 111
2
votes
2
answers
2k
views
DMZ layer for web server/presentation layer
I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
- 21
1
vote
2
answers
972
views
Is this considered directory traversal?
So I'm currently testing a site that has a url like this
example.com/dir1/dir2?nextPage=/someOtherDir/someHTMLfile.html
I found that I can do to get to the home page
example.com/dir1/dir2?nextPage=....
- 11
0
votes
1
answer
133
views
What is the correct course of action when a hash function used to hash passwords is compromised? [duplicate]
This is a hypothetical situation, not one I am currently in.
Suppose I'm using some hash function, call it H1, which is considered relatively safe currently to store passwords. I'm also using a salt. ...
- 101
0
votes
1
answer
249
views
Is this reponse vulnerable to xss?
My application is returning category parameter in json body as the following response..
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
P3P: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
...
- 173
1
vote
1
answer
326
views
Work from home, remote monitoring software, vpn, privacy
So I work for a company where I make and receive phone calls and connect to remote servers and workstations. I work from home, use a company laptop and connect to the company's network via software ...
- 11
3
votes
4
answers
211
views
Regarding Forget password security implementation
Need your suggestion on this.
Consider We have a mobile application and massive number of users. We want to implement secure password reset functionality with the consent of user experience.
...
- 319
0
votes
1
answer
90
views
What do the security warnings from cflint mean?
I am going to use the open source tool cflint but I would like to know what some of the warnings it lists actually mean or what they imply. The warnings in question are ones relating to security:
...
- 103
0
votes
4
answers
206
views
Security risks other than those [closed]
I'm working on ASP.NET core MVC website, and I don't know if I'm missing any security risks that I need to watch out for (other than logical ones)
Here is a list of what I've studied and what I've ...
- 23
1
vote
1
answer
797
views
What compliance does my mobile application need?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs ...
- 655
22
votes
1
answer
4k
views
Is assigning decrypted keys to a variable in application secure? [duplicate]
Let's say I've retrieved an encrypted secret key from the server. I decrypt it to get the actual secret key, assign the decrypted key to a variable in my app. Something along this:
const encryptedKey ...
- 367
1
vote
0
answers
120
views
Minimizing high risk obsolete application entry points
I am working on a .NET MVC based project involving an application with over 50,000 unique entry points.
Using our own custom static code analysis built using the .NET reflection libraries we have ...
- 503
1
vote
0
answers
83
views
How can I perform DAST on protocols other than HTTP/HTTPS
How can I perform DAST on protocols other than HTTP/HTTPS in case of a web application which does not have an URL but communicates with many other systems to pull or push data.
- 19
0
votes
1
answer
135
views
Malicious Twilio XML response object [closed]
So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio....
2
votes
1
answer
1k
views
Storing privacy sensitive data in a local application [closed]
We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
- 121
2
votes
2
answers
338
views
DRM - Make sure that a SDK is used by the client legally
We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement.
Especially,...
- 33
2
votes
1
answer
1k
views
Apparmor profile denying read access with r flag
I generated an apparmor profile for the tor binary that comes bundled in Ricochet:
# Last Modified: Sun Apr 2 2017
#include <tunables/global>
/ricochet/*-ricochet/tor {
#include <...
- 21
1
vote
0
answers
120
views
Is XSS possible when the user input gets reflected inside <textarea> when '<' and '>' symbols are sanitized [duplicate]
The scenario:
I have an application which takes user input and reflect everything to the following field in response.
<textarea rows="5" cols="32" name="test_name" tabindex="6">user input </...
- 3,891
2
votes
1
answer
158
views
How to justify a Vulnerability Research function at a company
From a business standpoint, how would you express the need for a vulnerability research team?
In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
- 610
5
votes
2
answers
3k
views
Is Segregation of Duties a Requirement?
In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
- 71
3
votes
1
answer
2k
views
Application security vs network penetration testing [closed]
I'm a web developer with about 7 years experience, but for the last 12 months I've been getting into cyber security so I've started implementing secure code practices and OWASP good practices at work. ...
- 59
0
votes
0
answers
249
views
Is Android Gmail safe from other apps?
By "safe" I specifically mean: safe from potential (unauthorized) access of other entities of Android system, such as third party applications.
While it's clear that no app is safe from users (in ...
- 153
2
votes
2
answers
9k
views
What happens when your secret API key is stolen and used by others?
The use of paid API is increasingly rising each year. For example, IBM, Google and Microsoft are providing paid API such as Text to Speech, Speech to Text and Image to Text and vice versa.
I have a ...
- 123
5
votes
1
answer
12k
views
jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line
I am working on fixing a potential security issue. I ran my HP fortify SCA and I got a critical priority report on my jquery.js file.
Category : Dynamic Code Evaluation: Code Injection (3 Issues).
...
- 53
3
votes
2
answers
287
views
A password substitute?
Currently, I have a website that logs users in, and then keeps track of ther session using PHPs $_SESSION. I'm trying to transfer this to an android app, which means I can't use sessions to keep track ...
- 143
17
votes
2
answers
13k
views
Vary: origin response header and CORS exploitation
Recently PortSwigger (guys behind Burp Suite) came up with a blog post discussing the security risks associated with CORS mis-configurations.
http://blog.portswigger.net/2016/10/exploiting-cors-...
- 7,375
2
votes
1
answer
197
views
Web App Scans scans through the network firewall?
I have a scenario. I want to scan a web app which is placed in another DC behind a different firewall(not web application firewall). We can have open ports to reach the application. The tools ...
- 331
4
votes
1
answer
2k
views
Difference between AppSec Pipeline vs DevSecOps
There is thing about implementing security in the early phases. Owasp mention implementing through AppSec Pipeline. DevOps folks talk about DevSecOps. Looking at the diagrams and phases of ...
- 1,275
-3
votes
3
answers
254
views
What information can a source code contain? [closed]
Can an application's source code contain the user name and/or the password?
If yes, How can we determine it?
Also what other information can it contain?
0
votes
3
answers
191
views
Effect of internet speed on Web App Security [closed]
I'm looking into Web App security and this question occurred to me:
What could be some possible effects of internet speed on Web app security?
I'm thinking of low latency, low bandwidth connections ...
- 11
0
votes
1
answer
267
views
What security considerations apply to a blockchain implementation for private use?
I want to know that if a company wants to implement a model of blockchain, let's say for internal transactions across its offices in different countries, what are the main and important security ...
- 73
-1
votes
1
answer
3k
views
How to pentest an .ica file [closed]
I need to pentest a .ica file [ a citrix file]. I need to log into citrix, download the .ica file. From this point - On launching the .ica file - I need to pentest. Any guidance on how to proceed, ...
1
vote
1
answer
131
views
Managing security of a desktop/mobile app
I'm working on an app that stores sensitive data (think of it as a password locker) for the UWP (Universal Windows Platform).
The most important requirement is the ability to roam the data between ...
- 111
2
votes
1
answer
614
views
What vulnerabilities other than directory traversal come under IDOR?
The most common vulnerability in the OWASP category Insecure direct object reference is directory traversal. What are the other vulnerabilities which fall into this category?
2
votes
1
answer
296
views
Is storing session data in the DMZ ok in an n-tier enterprise web application?
Say I have a standard multi-tier web application with web servers in the DMZ and multiple services only accessible from an authenticated web app. Also let's suppose the web app uses server-side ...
- 1,163
1
vote
0
answers
123
views
For a web application which employs application layer encryption, is there anyway to modify post parameters which is captured encrypted in burp.?
There is client side javascript controls in place which restricts malicious characters.
All form data is transmitted via POST requests. In burp, I can see that all parameters are encrypted into one ...
- 11
3
votes
1
answer
375
views
Why is it better to encrypt data in an application server than in the database server?
This is when protecting sensitive data in an application. As given in the OWASP Top 10: A6 Sensitive Data Exposure.
- 33
4
votes
1
answer
117
views
Android mobile application security testing
I am a newbie to Android application security. I would like to know how to tunnel the Android app traffic to Burp Proxy. I have already set the proxy in the emulator and that is working fine. But the ...
- 53
2
votes
0
answers
603
views
Testing thick client application over citrix
I am looking for a checklist or methodologies which can be adopted to test a thick client application over citrix environment. Owasp has listed some top 10 issues to look for in a thick client but as ...
- 51
1
vote
0
answers
121
views
How to share data securely between two Windows applications, not running at the same time?
Scenario: Let's say I'm on a Windows machine. I have a data-driven uninstaller application that knows how to uninstall/remove various types of things (apps, files, etc...).
Requirements:
Rather ...
- 113