Questions tagged [runtime]
Refers to vulnerabilities or protections that only apply to software while it is running - or at the point it time when it is executed. For questions about performance, please use the tag [performance].
12 questions
0
votes
2
answers
1k
views
Dynamic Application Security Testing (DAST) Scanner for Post Authentication [closed]
I am wondering if anyone know's of a DAST Scanner than can either take in an authenticated request from somewhere like burp, OR some DAST software that takes username and password and then run DAST ...
- 121
1
vote
0
answers
230
views
What does it mean to "run a command in memory"? [closed]
If I open a terminal and use the following commands, are they "run in memory"?
$ curl -s http://website.com/file.py | python - &
$ command=$(curl -s http://website.com/file.py); $(echo $command |...
- 11
2
votes
2
answers
2k
views
How to defend against a virus that hides the payload by encrypting it?
Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware:
...
user143530
2
votes
1
answer
2k
views
Runtitme Error page is being displayed for XSS or SQL injection payloads
When I have manipulated the URI of an application with some SQL or XSS payloads I am able to see a runtime error page. Can we come to a conclusion that the application is vulnerable to SQL Injection ...
- 343
3
votes
1
answer
2k
views
Dynamic analysis of Swift application using Cycript or gdb
I am doing analysis of a Swift iOS application. I am able to attach gdb or Cycript, but after that these tools are not able to do any method swizzling. I cant even call some method directly using ...
- 133
1
vote
2
answers
1k
views
How does Cycript / Cydia Substrate hook into processes?
I am currently doing some research on techniques about hooking mobile applications and came across some frameworks like Xposed (Android), Frida (Android and iOS) and Cycript (iOS).
The documentation ...
- 121
1
vote
1
answer
2k
views
How to validate the integrity of a library at run time?
I was looking at the FIPS certified version of OpenSSL and noticed that they need to execute an integrity check of the library every time it loads. As a result, the library needs to be loaded at a ...
- 3,286
0
votes
1
answer
188
views
Are scripts scanned by AVs at runtime?
Are malicious scripts like (.js, .wsf, VBA macros) scanned at runtime? I noticed that if a malicious script is not detected at scantime it won't be detected at runtime either, only the downloaded file ...
11
votes
0
answers
429
views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
- 423
12
votes
6
answers
5k
views
Can secrets be made safe in memory?
Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory?
So ...
- 1,375
6
votes
1
answer
218
views
Why does the issuance speed of a CA depend on the number of certs they have already issued?
I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
- 59.3k
5
votes
2
answers
238
views
application runtime separation - best practise
I need to persuade "the management" that running two or more unrelated business-critital applications within a single shared runtime environment (i.e. a single "command line") is a really bad idea. ...
- 455