Questions tagged [source-code]
Security relative to source-code edition, protection and management.
235
questions
6
votes
1
answer
4k
views
Hiding backdoors in Open Source code in other languages than C and C++?
I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
- 61
9
votes
1
answer
512
views
Do the Windows shared source files compile into the same binaries as the retail version?
Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative
Is this a ...
- 445
7
votes
2
answers
2k
views
In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?
I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
- 50.6k
3
votes
1
answer
2k
views
Scan Source Code for Potential Viruses
If you are sent a program written by someone so that you have the complete source code, how would you go about scanning the source code for any potential viruses/malware?
Note: While bugs and ...
- 143
46
votes
15
answers
12k
views
Should we protect web application source code from being stolen by web hosts through obfuscation?
Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate?
...
- 741
-3
votes
1
answer
257
views
Am I covered with GPL If I want to share open source code of project developed in my company? [closed]
I do not know if it's the right place to ask this question. But I find that this site is the closest site in the exchange sites to ask a such question.
I m working in a company and in my job contract ...
- 113
22
votes
2
answers
5k
views
Is there a way to verify a binary against the sources?
It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
- 381
0
votes
2
answers
449
views
Check integrity of GnuPG inside of GPGTools?
Is it possible to check the integrity of the GnuPG files inside of the downloaded installation package of GPGTools?
I know how to check the integrity of the .dmg file (compare the SHA1 hash), but I ...
- 381
14
votes
4
answers
4k
views
How dangerous is it to store password in plain text on sites like GitHub?
I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
- 243
-1
votes
2
answers
5k
views
How to protect my Exe file which written in c#.net? [duplicate]
I created one software which written in c#.net and when i created setup file .exe file will be the output but in this .exe file is ex tractable by some software and easy to access the codes.How to ...
- 1
0
votes
3
answers
3k
views
Password and username used to connect to database in source code [duplicate]
In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP
Do not ...
- 10.1k
2
votes
2
answers
3k
views
Tools to extract code comments from sites? [closed]
I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
- 11.5k
17
votes
5
answers
16k
views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
- 273
2
votes
2
answers
143
views
VCS to manipulate returned trees to prevent leaks? [closed]
I am wondering if there is any system that would change source code trees in subtle from version control systems in ways that are hard to discover (i.e. whitespaces at the ends of lines, perhaps even ...
- 6,514
2
votes
2
answers
1k
views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
- 123
5
votes
2
answers
2k
views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
- 2,779
31
votes
4
answers
15k
views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
- 419
5
votes
2
answers
1k
views
Can a virus infect source code files with dangerous data?
If a user was infected with a file altering virus is it possible that checked in code (files containing text) to the source control could contain dangerous properties.
I ask this after this got me ...
- 159
6
votes
4
answers
1k
views
Source code auditing and fake builds
I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain.
Say I would be a dishonest programmer that would wish to put in some backdoor into ...
- 365
10
votes
5
answers
28k
views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
- 10.1k
-1
votes
1
answer
400
views
How to prevent code injection like automatically adding extra character? [closed]
Code:
$result = "Hello World";
$jsonEncodeValue = $result;
echo $jsonEncodedValue;
Assumed Output:
"Hello World"
Real Output:
\n"Hello World"
This \n Line Feed added automatically.
For this ...
93
votes
7
answers
5k
views
How do I know a piece of software only does what the author claims?
Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
- 999
8
votes
2
answers
7k
views
Is there any decompiled source code for the "Flame"/"Skywiper" malware?
When searching for the source for Stuxnet, its relatively easy to come by in one form or another. Although I'm actually curious if anyone has done any work to comment the source and perhaps clean up ...
- 413
11
votes
5
answers
1k
views
Does naming sensitive things discreetly provide protection?
I had a job where a manager said he liked naming servers after places because if they were named descriptively e.g. "passwords database server" they become obvious targets. I sort of generalized this ...
- 10.1k
9
votes
4
answers
5k
views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
- 863
5
votes
1
answer
2k
views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
- 115
9
votes
7
answers
935
views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
- 212
-1
votes
1
answer
2k
views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
- 125
7
votes
3
answers
26k
views
Are there any free static analysis tools for C# / .NET code [closed]
A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
- 922
23
votes
6
answers
23k
views
What reputable site should I download Putty from?
I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.
If you needed to download Putty for a high security Windows ...
- 50.6k
5
votes
2
answers
4k
views
Tools for analyzing Perl 5 code? [closed]
I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'...
- 171
26
votes
4
answers
9k
views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
- 361
5
votes
6
answers
2k
views
Could a computer program be used to automate testing for trapdoors?
Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
- 101
10
votes
2
answers
8k
views
Average number of exploitable bugs per thousand lines of code?
Over the years I've heard various estimates for the average number of exploitable bugs per thousand lines of code, a common figure being one exploitable bug per thousand lines of code. A Google search ...
- 5,532
1
vote
2
answers
4k
views
Tampering req.getParameter() Vs req.getAttribute() [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = (String)request....
- 1,131
2
votes
2
answers
637
views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
- 10.1k
2
votes
2
answers
483
views
Which software scans software for potential vulnerabilities?
Is there any kind of parser software analysis tool that will analyze C code and outputs possible vulnerabilities like buffer overflows?
- 224
2
votes
4
answers
6k
views
Writing file shredder
I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that?
(1) Open the file with
...
- 3,861
13
votes
4
answers
2k
views
Source code security
We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS).
...
- 253
11
votes
2
answers
1k
views
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
- 223
3
votes
2
answers
2k
views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
user1187
2
votes
3
answers
2k
views
Securing dropdown boxes
I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured.
...
- 31
5
votes
0
answers
19k
views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
- 151
7
votes
3
answers
400
views
Should I store my intellectual property / code online?
As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much more....
- 173
4
votes
2
answers
2k
views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
- 539
14
votes
9
answers
62k
views
Programming language for network security
I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
- 386
5
votes
4
answers
11k
views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
- 2,585
5
votes
1
answer
1k
views
question for pentesters: PHP proc_open() in safe_mode
Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?
As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
- 71
0
votes
2
answers
786
views
TimThumb security alternative or fix?
"An image resizing utility called timthumb.php is widely used by many WordPress themes....The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code ...
- 1,092
5
votes
3
answers
651
views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
- 922