Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Validation (in contrast with verification) is assurance that a product, service, or system meets the needs of the stakeholders. It could contain the acceptance phase.

2
votes
0answers
53 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
31
votes
2answers
2k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
0
votes
1answer
84 views

Strange Email Validation request - should I worry about it? [duplicate]

I have a domain in .name zone registered in Germany. A couple of days ago I received an email, here is the English part of it: Dear customer (the German text has my name instead of "customer" here)...
0
votes
1answer
61 views

Is a constant pepper at risk if an attacker knows the value and hash?

My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...
1
vote
0answers
60 views

How to prevent a troll from exploiting my validation to annoy people?

My app has a demo mode where you can request a login to use the site in an unlimited way for a specific amount of time (15 days). At this point, the visitor is anonymous and we have no identifying ...
2
votes
3answers
77 views

When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?

Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
2
votes
1answer
71 views

How should Two Applications Authenticate between each other

I would like to understand which would be the best strategy for authentication between two applications running at different places. My application client needs to call the Rest API of a server, and ...
3
votes
1answer
251 views

Validate database column and table names to prevent SQLi?

There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...
0
votes
0answers
121 views

Testing of a Public key Infrastructure

I need to devise test scenarios to test according to the ISTQB standard (or there abouts). Testing should focus on functional tests such as certificate path validation, ensuring keys are backed up etc....
1
vote
0answers
38 views

Where I can find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
1
vote
1answer
984 views

Bypass Content Security Policy: Using Form tag

This article talks about bypassing CSP using Form tags. Edit: As suggested, details has to be provided in case the external link stops working. So here are the details: There is content-security-...
0
votes
1answer
104 views

CVSS score for no-input validation

During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that ...
6
votes
2answers
242 views

Why would some web applications disable Numpad input?

Some web applications (One popular example is Skrill) don't allow input from Numpad for number <input>. I've seen some local websites here also follow the same procedure. The thing is, all of ...
1
vote
0answers
431 views

Validating user input in authorization header (node.js express-validator)

I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "...
4
votes
1answer
3k views

MQTT over TLS - ca certificate on client

We are experimenting with MQTT in our project. We have a secure connection to our mqtt broker, so mqtt over TLS (or mqtts) and we use a proper signed certificate (not self-signed) from a trusted ...
4
votes
1answer
911 views

What specifically is “potentially dangerous” about an ampersand in a URL

ASP.NET includes a request validation system that halts page processing if any of the following characters are present in the path portion of the URL < > * % & : \ ?. Instead of the normal ...
6
votes
3answers
2k views

Why bother validating the hostname for a Google Recaptcha response?

Google's Recaptcha has hostname validation "baked-in". When a user submits a Recpatcha response, the domain from which the response was acquired is validated against the whitelist of domains you ...
115
votes
11answers
38k views

Hacker used picture upload to get PHP code into my site

I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness. First of all, a hacker figured out the password to log onto the ...
8
votes
1answer
2k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
0
votes
1answer
75 views

Certificate chain mantainance [closed]

According to standard rfc5280 , when user wants to validate a certificate, one step is to build a certificate chain, then check whether it is complete. I understand the idea to make a list to ...
1
vote
2answers
862 views

Why does Microsoft Windows not allow special characters in file and folder names? [closed]

I want to know whether it is done to enhance security of the named files? If yes, how? By special characters, I am asking about '<>"/\ Is there any way to bypass this check?
1
vote
0answers
294 views

Unable to use xssValidator on Burpsuite [closed]

I am trying to use the xssValidator extension on Burp using this tutorial: https://www.youtube.com/watch?v=qS5PsxYY1uc . I have installed xssValidator by going to the burp store under Extender tab-> ...
1
vote
2answers
121 views

OWASP ASVS asking for client-side validation?

While perusing ASVS 3.0.1 I came across requirement V5.18: Verify that client side validation is used as a second line of defense, in addition to server side validation. Umm... is client-side ...
1
vote
1answer
145 views

What is the best way to limit sending verification codes to mobile numbers which can be changed?

I'm developing a web based service in which users must validate their mobile phone (using a code sent to their mobile number via SMS) and email (using a verification link). Currently I use time ...
1
vote
1answer
91 views

Confusion about trusting certificate chains

Assume you have a client/server pair which wants to set up a secure connection using X509 v3 certificates and asymmetric cryptography. The client sends a chain of certificates (let's say Root CA: C1, ...
1
vote
2answers
4k views

How to reliably identify a certificate as root certificate in a chain [duplicate]

Assume you have a certificate (X509 v3) chain sent to you for validation. The chain sent to you may or may not include the root CA certificate. Is there a reliable way to find out whether this is the ...
0
votes
0answers
39 views

Proper way to document and log brute force attacks when creating a user account

We have the following use case: Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
2
votes
2answers
125 views

Why should I expire validator links after a while?

There are few kinds of links which validate something. For example when you create an account on a website, that website sends you an activating-link. You have to check your inbox and click on the ...
2
votes
1answer
104 views

How could I validate a security architecture? [closed]

Assume that I have identified certain vulnerabilities in a system and I have developed a security architecture to defend it. How could I properly validate my architecture (to prove that it does ...
4
votes
1answer
343 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
1
vote
1answer
330 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
3
votes
2answers
116 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is broken ...
5
votes
1answer
329 views

Is it easy to protect against SSI injection?

SSI injection is, to the best of my understanding, the process of injecting commands into user input fields, e.g. &lt;!--#exec cmd="ls" --&gt; to get the files in the current directory. ...
0
votes
1answer
89 views

Security concerns about Web browser [closed]

It seems that its like a black point in my mind that I think about browser when I research information security. Its clear that its the browser applies security rules while we navigate websites. In ...
0
votes
1answer
63 views

Authentication system for a web service

I am building a web service which i will be launching in near future. Service is more or less like online classifieds. Now, i need to build a mechanism to collect user's information, enough to trace ...
4
votes
1answer
170 views

Asking for Password After Email Validation?

I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
1
vote
1answer
279 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
0
votes
1answer
454 views

prevent form submission

Say in my cms I have a few page that only internal personnel could go to that page and submit sensitive information... how do I prevent from people fake a form to submit from that page? Assuming they ...
1
vote
2answers
58 views

form validation [closed]

To what degree of concern should I take when validating a form? What should be the general line to say enough? Currently, I'm checking form token submit value = match internal hard code input name = ...
2
votes
1answer
159 views

Explain OWASP Data Validation best practice example

I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here: Example - Scenario You are to ...
2
votes
1answer
179 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
19
votes
5answers
12k views

Input Sanitization vs Output Sanitization [duplicate]

In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
6
votes
1answer
276 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
0
votes
3answers
340 views

Should I be worried about SQL Injection for Internal Web Apps?

I've been working a lot lately with writing report generating forms at work. The reports sometimes require input provided by a drop-down list and sometimes require data to be entered by key. My ...
0
votes
1answer
68 views

Validating the ROA certificate

Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix. Now if the client attaches the ROA certificate ( ...
3
votes
1answer
180 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
3
votes
1answer
1k views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
2
votes
2answers
3k views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
1answer
35 views

Expand user login in Path - Filter malicious values

I have a function that takes a pathname and substitutes every occurrence of '%u' with a given String. For my scenario this given String is the login that a user/attacker enters via ssh during ...
4
votes
2answers
3k views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...