New answers tagged appsec
3
If there is an XSS vulnerability, the attacker has won. If you can execute arbitrary JavaScript on the victims machine in the target origin, you can do whatever you want - you don't need to bypass any CSRF protection to wreak havoc.
Also, no CSRF protections survive an XSS vulnerability. A referer header check does not help, since the attacker can just send ...
0
Lack of specificity means that there are potentially more paths through the program, and the more paths there are, the harder it is to verify its properties, including its security. This decreases one's confidence in its security.
In particular, a broad catch may make it possible for a user to force a jump to the catch block from more places than was ...
5
I have been dealing with code audits, security analysis like this one and ethical hacking runs for a decade and a half now, so let me share some of my experience.
Every single boss and team lead I've had that I saw as a role model insisted on haviing high standards for code quality, not just to make code reviews easier but also in name of stability, ...
5
Bad guys start an attack by learning as much as possible about the target system. An improperly handled exception can reveal sensitive information to the calling client.
In a REST API for example, a typical successful GET response would include requested object and a 200 HTTP status code, but little else about the server implementation.
A response for a ...
2
These kind of code quality issues may lead to security issues depending how it's implemented. That's the reason why we have SAST tools in placed to detect this kind of issues at early stage of development.
You need to improve your error handling.
49
I think you are correct that those issues are more related to code quality rather than security, and none of them are exploitable in any obvious way. I would not call them "vulnerabilities".
But vulnerabilities are born out of bugs, and bugs are born out of bad code quality. Bad error handling could lead to unexpected results - i.e. a bug - and if you are ...
11
How are these related to security? According to my understanding it
seems like the above issues are code quality issues.
These are code quality issues. From the name, it looks like they are straight out of Fortify. Fortify has the ability to look for code quality issues and it looks like your security team enabled those rules while running the scans.
...
2
Security is rarely a binary proposition: whether or not something is a security concern depends on the circumstances. The sort of security you need for an anonymous cat-picture voting site is different than the security needed for the president to launch a nuclear assault. As a result, only your development team can decide if this is a security concern.
...
0
If the session IDs are indeed encrypted due to HTTPS, are we still
able to determine if the session IDs are sufficiently random and
unpredictable? I was asking myself this question and for me, a close
and probable answer I would give myself, is no. (I might be wrong)
To read the session ID used by an application, you don't necessarily need any tool ...
0
If the session IDs are sufficiently random and unpredictable?
To check just for randomisation and unpredictability, I use myself Burp Suite - Sequencer.
Burp Suite Community edition is free to use.
You would actually need to have access to the internal web application code?
Sequencer can make any request where in response you get ID you want to check. ...
2
The SGX enclave uses a built-in secret key for transmission of information to and from the enclave. Even if you wrap SGX in rogue software, you still cannot decrypt information sent to it. The best you can do with rogue software is trick a client in sending you encrypted data.
The vulnerability lies with a rogue SGX manufacturer who could save the built-in ...
0
You can't invoke a command from a regex, so you can't do an SQL injection in this case.
However, you could enter a very long processing regex that would certainly cause issues with the web site. For example forward lookahead with multiple wildcards (see Mastering Lookahead and Lookbehind).
here is an example (in Java regex).
(([$_a-zA-Z][$_a-zA-Z0-9](?:.[$...
Top 50 recent answers are included
