Questions tagged [validation]
Validation (in contrast with verification) is assurance that a product, service, or system meets the needs of the stakeholders. It could contain the acceptance phase.
126
questions
1
vote
1
answer
729
views
Validate File Uploads in PHP: PDFs and images
We're trying to secure our upload forms in PHP regarding image uploads and PDF files. For this purpose, we're currently trying to do the following in all cases, according to our research done so far:
...
- 131
1
vote
2
answers
126
views
What's the shortest message you need to claim ownership of another message?
Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following.
The hash/ characteristic string is compact enough (ideally a few ...
- 121
2
votes
1
answer
149
views
When a detection tool fires no alert, how to tell the difference if the environment is safe or just something is wrong with the tool
For example, if an antivirus gives no alert for a couple of months, how do you confirm if the antivirus is working to prevent viruses, and not just hung?
- 121
1
vote
3
answers
255
views
Should password strength validation also be run server-side or only client-side?
Personally, I think that it's not so important to check the strength of the passwords on server-side, since, if the user evades the validation on the client side, it would be their responsibility to ...
- 13
0
votes
0
answers
201
views
How to determine validation process of a certificate used by a website using HTTPS?
When visiting a website that uses HTTPS, we can see its certificate in the browser. But how can we know for sure which validation process the company or domain behind the website has gone through?
...
user279925
1
vote
1
answer
172
views
Best practice for "stateOrProvinceName" in certificate
In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
- 4,633
0
votes
1
answer
50
views
Processing Parameters passed in URL String from a Third Party
I'm working with a developer to develop a web application. For one aspect of this application, I need to allow hundreds of merchants to deliver non-PII and non-sensitive data to my website. The data ...
- 129
1
vote
1
answer
222
views
How may I check if an expired certificate was valid at the time?
I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active.
How may I check if it was valid at the time?
- 178
-1
votes
2
answers
366
views
How does DNS-01 validation for LetsEncrypt know what the right IP address is?
For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
- 166
0
votes
1
answer
618
views
If a file is digitally signed, is posting a hash very useful for security purposes?
In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
- 3,134
1
vote
0
answers
233
views
When file hash not available, how to best check authenticity of a file?
Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this.
However, for their current release (...
- 3,134
0
votes
1
answer
265
views
Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?
Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
5
votes
0
answers
271
views
What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?
I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general.
So, PAdES has the concept of Long Term Validation, which ...
0
votes
0
answers
944
views
Sanitising data for a flutter application
I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
- 101
0
votes
1
answer
119
views
Is there any reasonable argument against immediately validating a new customer's email address? [closed]
Would it not be useful for account providers that allow online/phone signup/ordering to immediately verify the email address supplied to them?
I was forced to ponder this recently when I became the ...
- 9
3
votes
1
answer
498
views
Why does Windows consider a certificate valid even after its expiration time?
I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
- 33
1
vote
1
answer
359
views
QES AdESQC TL based Signature Validation Policy
Reading the ETSI EN 319 102-1 V1.1.1 (2016-05) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation.
The ...
- 1,119
1
vote
1
answer
2k
views
Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks?
I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, ...
- 2,267
0
votes
1
answer
144
views
What type of vulnerabilty is this?
I'm testing a website:
https://this-site.com/path/to/dirs
but what i've found is if I do the following below the site will load 4 pages in a infinite loop
https://this-site.com/path/to/dirs/.../.
...
- 35
1
vote
2
answers
219
views
Is UTF-8 malleable?
I've got two byte sequences, and I decode them as UTF-8 (in strict mode to be sure they're valid UTF-8).
Is it correct to assume that, if the bytes are different, the decoded codepoints will also be ...
- 121
1
vote
0
answers
137
views
Manipulation-save logging
I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal.
What options do I have?
E.g. an option in syslogd, or a table configuration in MySQL ...
- 111
1
vote
1
answer
407
views
Safe to switch from PBKDF2 to SHA-1 for token verification?
Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
- 113
242
votes
12
answers
29k
views
Is single quote filtering nonsense?
Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value.
While I'm aware that single quotes ...
- 1,791
0
votes
1
answer
539
views
What to take into account when validating file upload
One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks.
Most of the ...
- 304
2
votes
1
answer
153
views
What security precautions should we take when letting a C# application send/receive emails?
I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
- 549
32
votes
2
answers
3k
views
How does subresource integrity actually help?
Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect.
But this assumes that I'm already running on some ...
0
votes
1
answer
185
views
Strange Email Validation request - should I worry about it? [duplicate]
I have a domain in .name zone registered in Germany. A couple of days ago I received an email, here is the English part of it:
Dear customer (the German text has my name instead of "customer" here)...
- 103
0
votes
1
answer
168
views
Is a constant pepper at risk if an attacker knows the value and hash?
My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...
- 207
1
vote
0
answers
118
views
How to prevent a troll from exploiting my validation to annoy people?
My app has a demo mode where you can request a login to use the site in an unlimited way for a specific amount of time (15 days). At this point, the visitor is anonymous and we have no identifying ...
- 207
2
votes
3
answers
209
views
When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?
Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
- 525
2
votes
1
answer
1k
views
How should Two Applications Authenticate between each other
I would like to understand which would be the best strategy for authentication between two applications running at different places.
My application client needs to call the Rest API of a server, and ...
- 121
4
votes
1
answer
1k
views
Validate database column and table names to prevent SQLi?
There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...
- 65.4k
1
vote
1
answer
2k
views
Bypass Content Security Policy: Using Form tag
This article talks about bypassing CSP using Form tags.
Edit: As suggested, details has to be provided in case the external link stops working.
So here are the details:
There is content-security-...
- 1,801
1
vote
1
answer
673
views
CVSS score for no-input validation
During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that ...
- 879
7
votes
3
answers
1k
views
Why would some web applications disable Numpad input?
Some web applications (One popular example is Skrill) don't allow input from Numpad for number <input>.
I've seen some local websites here also follow the same procedure.
The thing is, all of ...
- 79
2
votes
0
answers
2k
views
Validating user input in authorization header (node.js express-validator)
I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "...
- 81
4
votes
1
answer
6k
views
MQTT over TLS - ca certificate on client
We are experimenting with MQTT in our project.
We have a secure connection to our mqtt broker, so mqtt over TLS (or mqtts) and we use a proper signed certificate (not self-signed) from a trusted ...
- 883
4
votes
1
answer
3k
views
What specifically is "potentially dangerous" about an ampersand in a URL
ASP.NET includes a request validation system that halts page processing if any of the following characters are present in the path portion of the URL < > * % & : \ ?. Instead of the normal ...
14
votes
3
answers
11k
views
Why bother validating the hostname for a Google Recaptcha response?
Google's Recaptcha has hostname validation "baked-in". When a user submits a Recpatcha response, the domain from which the response was acquired is validated against the whitelist of domains you ...
- 316
120
votes
11
answers
54k
views
Hacker used picture upload to get PHP code into my site
I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness.
First of all, a hacker figured out the password to log onto the ...
- 1,285
16
votes
1
answer
12k
views
What's the difference between escaping, filtering, validating and sanitizing?
An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
- 44.7k
0
votes
1
answer
345
views
Certificate chain mantainance [closed]
According to standard rfc5280 , when user wants to validate a certificate, one step is to build a certificate chain, then check whether it is complete. I understand the idea to make a list to ...
- 3
2
votes
2
answers
3k
views
Why does Microsoft Windows not allow special characters in file and folder names? [closed]
I want to know whether it is done to enhance security of the named files? If yes, how? By special characters, I am asking about '<>"/\
Is there any way to bypass this check?
- 1,801
1
vote
0
answers
475
views
Unable to use xssValidator on Burpsuite [closed]
I am trying to use the xssValidator extension on Burp using this tutorial: https://www.youtube.com/watch?v=qS5PsxYY1uc .
I have installed xssValidator by going to the burp store under Extender tab-> ...
- 11
1
vote
2
answers
236
views
OWASP ASVS asking for client-side validation?
While perusing ASVS 3.0.1 I came across requirement V5.18:
Verify that client side validation is used as a second line of defense, in addition to server side validation.
Umm... is client-side ...
- 714
1
vote
1
answer
742
views
What is the best way to limit sending verification codes to mobile numbers which can be changed?
I'm developing a web based service in which users must validate their mobile phone (using a code sent to their mobile number via SMS) and email (using a verification link). Currently I use time ...
- 867
1
vote
1
answer
146
views
Confusion about trusting certificate chains
Assume you have a client/server pair which wants to set up a secure connection using X509 v3 certificates and asymmetric cryptography.
The client sends a chain of certificates (let's say Root CA: C1, ...
- 131
2
votes
2
answers
19k
views
How to reliably identify a certificate as root certificate in a chain [duplicate]
Assume you have a certificate (X509 v3) chain sent to you for validation. The chain sent to you may or may not include the root CA certificate. Is there a reliable way to find out whether this is the ...
- 131
0
votes
0
answers
89
views
Proper way to document and log brute force attacks when creating a user account
We have the following use case:
Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
- 121
2
votes
2
answers
261
views
Why should I expire validator links after a while?
There are few kinds of links which validate something. For example when you create an account on a website, that website sends you an activating-link. You have to check your inbox and click on the ...
- 163