Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [source-code]

Security relative to source-code edition, protection and management.

0
votes
0answers
88 views

CVV/CVC code algorithm [duplicate]

I'm looking for a definition of algorithm how to calculate CVV/CVC codes? I know that there are the following inputs: PAN Expiration Date Service Code CVK A/B But I'm not able to find the specific ...
1
vote
3answers
278 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
2
votes
1answer
238 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
0answers
37 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
40
votes
5answers
5k views

How should source code security be checked?

How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
2
votes
1answer
76 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
1
vote
2answers
140 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
5
votes
3answers
190 views

cases where companies suffered losses due to leaks of source code?

The damage associated with data breaches apparently caused Equifax to lose $4 billion in value and Facebook to lose about $50 billion, and even if not every dollar of those losses was due to the ...
0
votes
1answer
76 views

How curl provided source code that the browser did not?

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? ...
1
vote
1answer
148 views

ISO 27001 and copying code from stackoverflow

So ever since we got certified, every time some code from stackoverflow is shown the ISO 27001 argument comes up "we can't copy code". As a dev, I have to say not allowing code form stackoverflow is ...
117
votes
8answers
19k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
0
votes
1answer
209 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
0
votes
2answers
118 views

Restricting source code exposure

Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them. Also, say you want to keep certain files inaccessible to people ...
0
votes
4answers
148 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
48 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
2
votes
2answers
350 views

Protecting Python source code on physical product?

How would you protect Python source code on a physical product (like a IoT device), which comes with Ubuntu installed on a mini-PC running Python code? Few methods we thought about: Compiling the ...
-2
votes
1answer
311 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
1
vote
2answers
348 views

How to make a well-known malicious programs undetectable by anti-virus solutions? [closed]

I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions. I have already tried various approaches myself, like packing the binary with UPX or ...
0
votes
1answer
594 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
-1
votes
1answer
64 views

Secure PHP coding without frameworks

I am very new to PHP and some people said that writing PHP code without a framework is insecure. I am not sure about that! Is it possible to write highly secure code without any frameworks? If so, ...
1
vote
1answer
329 views

How to perform taint analysis on Java source code? [closed]

I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java ...
0
votes
2answers
516 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
1
vote
1answer
105 views

Is it safe to commit ascii-armored symmetric private key to VCS?

What is the risk of committing an ascii-armored symmetric private key to VCS where the password lives outside of source control? This is a private closed-source repo. Two helpful topics: When can I ...
1
vote
0answers
23 views

Can files be retrieved from a VM instance state that was initially encrypted on a disk?

If I were to make a VM disk that was encrypetd, boot it, enter the encrypted passphrase and save the resulting 'image state' (of the running VM). Would this image have the 'encrypted' files easily ...
3
votes
1answer
88 views

How protected are files within a running encrypted VM on a possibly non secure hypervisor / host?

I've got a set of source code files (compiled C#) that I want to prevent direct read access to. The program will be running on the VM. I was thinking of storing these in an encrypted hard disk VM, the ...
1
vote
1answer
100 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
0
votes
1answer
208 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
1
vote
2answers
1k views

Buffer overflow due to strlen, strcpy, strcat

I'm new to secure code review. I know that strlen will calculates the length until it finds a null character. This is a part of a larger code. char* executeMount(char* password, char* path, int ...
1
vote
0answers
99 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
0
votes
2answers
196 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...
0
votes
2answers
92 views

What are the security trade-offs of using reproducible builds?

From reproducible-builds.org: Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers. In ...
4
votes
1answer
3k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
0
votes
1answer
3k views

CVE-2017-7529 - Exploit details? [closed]

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7529 Where can I find the exploit details for this CVE? Usually sites like exploit-db.com include the PoC exploit for a given vuln but I can't ...
1
vote
1answer
104 views

Job applicants submit code, how do companies securely test it?

Applicants for software engineering jobs sometimes go through coding challenges as part of the interview process. The company may send applicants code and a development task with a deadline, and ...
1
vote
0answers
292 views

Was double pulsar's source code ever released?

Double Pulsar I can only see a binary at this address: https://github.com/x0rz/EQGRP_Lost_in_Translation News articles seem to not discriminate between the source code and the binary
1
vote
1answer
140 views

What are methods against code leakage for web applications?

I like to see the server-side web application layer as independent as possible, from the OS, from the server software like (Apache, nginx, IIS, et cetera). In order to easily grab the application and ...
0
votes
1answer
95 views

secure the code of a server physically rented to the client

My company rents a Debian server to the clients, that they have to connect to their own network. The server provides various services, an administration interface, and connects to the online service ...
1
vote
2answers
815 views

C++ standard library use in malware

I was recently analyzing the sources of ZeuS, ZeroAccess, Carberp and other professional malware and there was one thing which I found weird: The authors did not use the standard library std::-...
3
votes
2answers
1k views

Manually exploiting blind SQL injection in SELECT statement in X-Forwarded-For header

I am struggling exploiting this vulnerability in the code below: <?php ini_set('display_errors', 0); define("INDEX", 1); include '../db.php'; if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) &&...
0
votes
1answer
37 views

Ensuring security for SharePoint hosted app (Office 365) [closed]

What strategy/approach/method should I use to ensure that programmers aren't deliberately including backdoor or accidentally creating security flaws? This is in regards to SharePoint hosted app in ...
1
vote
0answers
113 views

Is there a public malware sample of WannaCry? [duplicate]

Google security researcher Neel Mehta has famously identified code similarities between a sample of WannaCry and code used by North Korean hacker group Lazarus in 2015. Around the same time, another ...
1
vote
0answers
82 views

Minimizing high risk obsolete application entry points

I am working on a .NET MVC based project involving an application with over 50,000 unique entry points. Using our own custom static code analysis built using the .NET reflection libraries we have ...
0
votes
0answers
49 views

Recognized complement to OWASP's ASVS requirements

The OWASP ASVS focuses on web-application verification. It is free and recognised worldwide as a good reference to build upon, or simply reuse. It is useful to use it when outsourcing web development. ...
2
votes
0answers
310 views

How is the use of java reflection api java.lang.reflect.get* is not safe? [closed]

Below is the code which is making a private field of a class accessible using setAccessible method of java reflection and getting the field value using java.lang.reflect.get method, finally setting is ...
24
votes
2answers
4k views

Access to the codebase in big companies [duplicate]

I am wondering how big companies manage access to their codebase from their developers. In order to make their code safe do they allow their developers to have access to entire codebase or to only ...
1
vote
1answer
57 views

Enforce single-domain licenses for a WordPress theme

I'm having a WordPress theme which users can purchase. You are allowed to use one single license on a single website and I'm identifying websites by their domains. A single purchase is identified with ...
5
votes
1answer
335 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
-3
votes
3answers
135 views

What information can a source code contain? [closed]

Can an application's source code contain the user name and/or the password? If yes, How can we determine it? Also what other information can it contain?
1
vote
0answers
357 views

Is it possible to obfuscate binaries with UPX or similar software?

Warez scene groups often compress their binary executables using UPX or similar software. I've heard somewhere that they do this to obscure the algorithms they use from other groups, but I find this ...
9
votes
2answers
315 views

Given a vulnerable JavaScript snippet from a Stack Overflow answer, how can I cheaply find websites whose authors have copied and pasted it?

Frequently, Stack Overflow answers to JavaScript questions contain XSS vulnerabilities (or vulnerabilities of other kinds). For instance, this answer with 420 upvotes and a quarter of a million views ...