Skip to main content
93 votes
Accepted

Security implication if android app can be installed on emulator

It is unclear what kind of security requirements you have in the first place and thus it is unclear if your security measures are sufficient or not. Fully protecting against a malicious user using ...
Steffen Ullrich's user avatar
79 votes
Accepted

Is an up-to-date browser secure on an out-of-date OS?

Do not use an outdated OS, even with a modern browser. Assuming that after that day I still use an updated browser, is it true that I'm still safe? No, you cannot avoid browser-based security ...
forest's user avatar
  • 67k
68 votes
Accepted

Security risks of fetching user-supplied URLs

This particular vulnerability indeed has a name. It is called Server-Side Request Forgery (SSRF). SSRF is when a user can make a server-side application retrieve resources that were unintended by the ...
multithr3at3d's user avatar
49 votes

Poor error handling source code review

I think you are correct that those issues are more related to code quality rather than security, and none of them are exploitable in any obvious way. I would not call them "vulnerabilities". But ...
Anders's user avatar
  • 65.7k
40 votes

Increasing trust in a downloaded binary

A hash only really gives assurance that the file you downloaded matches the one on the website, not who the author was. So a digital signature using something like GPG (with your key publicly ...
Gh0stFish's user avatar
  • 13k
32 votes

Why does XSS affect so many websites?

XSS is a form of code injection, i.e. the attacker manages to inject its own malicious code (usually JavaScript) into trusted code (HTML, CSS, JavaScript) provided by the site. It is similar to SQLi ...
Steffen Ullrich's user avatar
32 votes
Accepted

Is assigning decrypted keys to a variable in application secure?

Yes, it does mean that the key will be stored in the application’s memory. Yes, there is a risk that malware (with sufficient privilege) can read it from there. This risk is hard to avoid — if you ...
Anders's user avatar
  • 65.7k
32 votes

Security risks of fetching user-supplied URLs

We store the URL instead of the image. In addition, this will add information and privacy risks. Let me show with a visual demo. If you try to upload any image to StackExchange, you will notice that ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
28 votes

Security risks of fetching user-supplied URLs

Instead of uploading an image, the user can provide the (self-hosted) URL of an image. We store the URL instead of the image. You mean these kind of JPEGs? It is a bad idea. First of all, you will ...
Ljm Dullaart's user avatar
  • 2,150
26 votes

Security implication if android app can be installed on emulator

Whose security are you concerned for here, and what are you trying to protect? Are you trying to protect the users from having other people access their data, or are you trying to protect the company ...
Qwertie's user avatar
  • 778
22 votes

Why does XSS affect so many websites?

It seems easy, but is hard First of all, the attack surface is huge. You need to deal with XSS if you want to display user input in HTML anywhere. This is something almost all sites do, unless they ...
Anders's user avatar
  • 65.7k
21 votes
Accepted

Split an application into user and admin parts for security reasons?

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can ...
Stephane's user avatar
  • 18.7k
21 votes

Note Taking App Hacked?

It sounds like this is a pocket fumble. Predictive text would explain the coherent words, then the random letters all around the same area of the keyboard (where one might hold a phone when putting in ...
Tanenthor's user avatar
  • 311
18 votes
Accepted

Is it safe to send sensitive data in the post body to an azure function?

Sending sensitive data in a post request is a common approach. Take any form-based authentication mechanism for example. A user enters his credentials in the web-frontend (browser) and a post request ...
Demento's user avatar
  • 7,495
17 votes

How do you capture ALL the traffic from an Android app?

You are unable to intercept Facebook traffic because it uses SSL pinning. On pen-testing an android application you may come across four different scenarios. I will list them down below concisely. A ...
hax's user avatar
  • 3,941
15 votes
Accepted

Vary: origin response header and CORS exploitation

It's important to include the Vary: Origin header to prevent caching. The header indicates that the response is in some way dependent on the origin and should therefore not be served from cache for ...
Arminius's user avatar
  • 45k
15 votes

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

I think you're asking: If the page at https://host1/ contains an <iframe> which loads https://host2/, does that mean the HTTPS connection to host1 somehow wraps the connection to host2? No. ...
Arminius's user avatar
  • 45k
14 votes
Accepted

How good are Angular Route Guards from a security standpoint?

Any client side restriction can be circumvented by an attacker. No client side restrictions should be relied upon to protect private data. These facts apply to all systems, and the fact that you are ...
Conor Mancone's user avatar
14 votes

Security implication if android app can be installed on emulator

The classic and correct answer to your client is NOTANISSUE. No client side software * * should ever be considered to be designed as secure, in the sense your question asks. They can't be. The client ...
Stilez's user avatar
  • 1,694
13 votes

Is an up-to-date browser secure on an out-of-date OS?

One benefit of the newer operating systems, like Windows 10 over Windows 7, is that they have more advanced features built in to the operating system to protect against entire classes of ...
kepstin's user avatar
  • 131
11 votes

Poor error handling source code review

How are these related to security? According to my understanding it seems like the above issues are code quality issues. These are code quality issues. From the name, it looks like they are ...
hax's user avatar
  • 3,941
10 votes

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

In most cases some man in the middle which is able to passively inspect the traffic can find out the hostname of all sites accessed. This is because this information is contained in the TLS handshake ...
Steffen Ullrich's user avatar
9 votes

Protecting against cross-subdomain cookie attacks

Public Suffix has a list of domains that all vendors (Chrome/Firefox/IE/Safari/Opera) use to avoid this problem of stealing cookies from other subdomains (along side other features). The list is ...
Sairam's user avatar
  • 723
9 votes

How can I enumerate all the saved RSA keys in the Microsoft CSP?

Same answer as @ian but as a Powershell script. In this example reading the machine keys. $containerPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" Get-ChildItem $containerPath | ForEach-...
8DH's user avatar
  • 191
9 votes
Accepted

Online Diffie-Hellman Tool

How DH parameters are generated There are two types of generators for DH parameters. Each generator has two steps: a step that requires random input, and a deterministic step. The two steps are the ...
forest's user avatar
  • 67k
9 votes

What is the relationship between HTTP response codes and successful execution of XSS attacks?

TL;DR: Successful execution of XSS is unrelated to the response code. XSS is the execution of attacker injected code at the client side. The HTTP response which includes the response code is created ...
Steffen Ullrich's user avatar
9 votes

How do I sell critical vulnerability info to private company?

Responsible disclosure, which most people on this site seem to endorse (including me), and is regarded as the most ethical way to notify a company of a vulnerability, is precisely what your comment ...
Ghedipunk's user avatar
  • 6,060
9 votes

Security implication if android app can be installed on emulator

I'm readign between the lines here, but I think I see where the researcher is coming from. Your app has no business storing (or using) any secrets that could expose the data of other customers. ...
Jasen's user avatar
  • 1,226
8 votes
Accepted

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is ...
Mark E. Haase's user avatar
8 votes
Accepted

What happens when your secret API key is stolen and used by others?

As you may expect it, there is no way to fully protect your api key if it is directly used by a client application. The user can sniff his netowrk (the use of https or of an encrypted channel might ...
Xavier59's user avatar
  • 2,904

Only top scored, non community-wiki answers of a minimum length are eligible