Questions tagged [runtime]

Refers to vulnerabilities or protections that only apply to software while it is running - or at the point it time when it is executed. For questions about performance, please use the tag [performance].

Filter by
Sorted by
Tagged with
0 votes
2 answers
589 views

Dynamic Application Security Testing (DAST) Scanner for Post Authentication [closed]

I am wondering if anyone know's of a DAST Scanner than can either take in an authenticated request from somewhere like burp, OR some DAST software that takes username and password and then run DAST ...
user avatar
  • 121
1 vote
0 answers
132 views

What does it mean to "run a command in memory"? [closed]

If I open a terminal and use the following commands, are they "run in memory"? $ curl -s http://website.com/file.py | python - & $ command=$(curl -s http://website.com/file.py); $(echo $command |...
user avatar
2 votes
2 answers
2k views

How to defend against a virus that hides the payload by encrypting it?

Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware: ...
user avatar
2 votes
1 answer
1k views

Runtitme Error page is being displayed for XSS or SQL injection payloads

When I have manipulated the URI of an application with some SQL or XSS payloads I am able to see a runtime error page. Can we come to a conclusion that the application is vulnerable to SQL Injection ...
user avatar
3 votes
1 answer
2k views

Dynamic analysis of Swift application using Cycript or gdb

I am doing analysis of a Swift iOS application. I am able to attach gdb or Cycript, but after that these tools are not able to do any method swizzling. I cant even call some method directly using ...
user avatar
  • 133
1 vote
2 answers
1k views

How does Cycript / Cydia Substrate hook into processes?

I am currently doing some research on techniques about hooking mobile applications and came across some frameworks like Xposed (Android), Frida (Android and iOS) and Cycript (iOS). The documentation ...
user avatar
  • 121
1 vote
1 answer
1k views

How to validate the integrity of a library at run time?

I was looking at the FIPS certified version of OpenSSL and noticed that they need to execute an integrity check of the library every time it loads. As a result, the library needs to be loaded at a ...
user avatar
  • 3,191
0 votes
1 answer
134 views

Are scripts scanned by AVs at runtime?

Are malicious scripts like (.js, .wsf, VBA macros) scanned at runtime? I noticed that if a malicious script is not detected at scantime it won't be detected at runtime either, only the downloaded file ...
user avatar
10 votes
0 answers
326 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
user avatar
  • 393
10 votes
5 answers
2k views

Can secrets be made safe in memory?

Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory? So ...
user avatar
  • 1,315
6 votes
1 answer
170 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
user avatar
6 votes
2 answers
194 views

application runtime separation - best practise

I need to persuade "the management" that running two or more unrelated business-critital applications within a single shared runtime environment (i.e. a single "command line") is a really bad idea. ...
user avatar
  • 455