This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

7
votes
0answers
48 views

Crypographically-secure super-secret government message transaction machine

-Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? ...
0
votes
0answers
15 views

Security risk stemming from data passed in $_GET superglobal [migrated]

This is a short but general question. I am relatively new to programming in general. My site,w which is predominately written in PHP, will be launched soon and is undergoing some security tightening. ...
4
votes
0answers
41 views

Java secured cookie - security issues?

I tested the play framework the last days and had mixed feelings about it. In the end, I don't use play for my new REST project. I use http://www.sparkjava.com as minimal server setup. But I really ...
13
votes
3answers
1k views

How is my CMS design? Any security, design, or other issues?

I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can... The way I am trying to design this CMS is to keep including 'modules' within a page ...
5
votes
1answer
44 views

Clarity of encryption class

I have recently gotten back into development and I am wondering if the script I have just created is clearly documented and easily understandable throughout each step. Is it easy to understand? ...
3
votes
1answer
27 views

Login system, PDO and me - Part 2

This is a follow up question to: Login system, PDO and me Is this considered secure for a login script? ...
5
votes
1answer
55 views

Secure password-hashing in Java

Here is an article on password hashing, along with an implementation. Is this code secure with number of iterations 10000, key length 256 and salt bytes 32? Is there a rule-of-thumb for key ...
7
votes
2answers
475 views

Protect database from SQL Injection and similar attacks - PHP

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
2
votes
0answers
24 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...
4
votes
0answers
82 views

Password-hashing method in Java [closed]

There is an article on Crackstation where they show you how to hash a password correctly. I've implemented the Java version of it which is working fine, but is the method they use secure? ...
6
votes
3answers
309 views

Functions to escape CSS rules in PHP

Some context I've been tasked with supplying an escaping function to arbitrary CSS values that are entered through a form. The goals and caveats are: I know it's bad practice to let users input ...
4
votes
1answer
113 views

Preventing session hijacking

I'm implementing a login script and I want it to be more secure: ...
3
votes
2answers
162 views

Updating necessary data using just one function

My objective is to update necessary data using one function instead of having different functions to update different fields. So, I've created one and I think this is not really elegant, efficient or ...
1
vote
3answers
119 views

Security of code snippets

Last time I made a website using PHP, I didn't know of PDO, so someone dropped all my tables. I think I've made an improvement now. I'm sorry if there's a lot to go through, but I want to make sure ...
4
votes
1answer
42 views

Simple file downloader

On my website I want to offer some PDFs, ZIP files and images for download. They are all in the same folder and I could simply link to them like ...
2
votes
1answer
47 views

Login System Security Part 2

Old code: Login system security This is an update on the code and suggestions I received from generous users on the old thread. So same rules apply, just check it out, tell me what you think. Is ...
7
votes
4answers
486 views

Is this PHP code snippet safe?

Mostly asking for critiques of vulnerability. Am I using any functions or methods that are unsafe? ...
2
votes
2answers
74 views

Preg_match pattern for user input filtering

My users may need to supply a 'disease category' to my site. I need to let them use all alphanumeric characters, hyphens and single quotes. Would someone review this to see if they feel it's ...
2
votes
1answer
48 views

Is this `img` creator decently secure from XSS?

This is being used now, seems decent to me but I'm curious. ...
4
votes
1answer
109 views

Login system security

Here is a login system I am working on. I just want an opinion on it and whether I am going in the right direction or am just completely missing something. The main thing I would like to know is: am ...
1
vote
0answers
43 views

How to regenerate my session ID often when using this class?

I have created a class that will manage my session. I am hoping to acomplish a class that will secure my site from all known attacks (ie. fixation, precedent, and capture.) The idea is to Change ...
2
votes
2answers
58 views

String sanitisation function

I have a search function on my website. In addition, elsewhere I have a place where users can submit categories for their posts. I want the categories to have an uppercase first letter and the rest ...
2
votes
1answer
111 views

SQL injection security

I wanted to know if this code is safe against SQL injection or not? Also do I need to mysqli_close if I already did the ...
1
vote
2answers
60 views

Controlling permissions in a MVP application

In a Windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as ...
4
votes
1answer
55 views

Entire PDO DB Class

Last time I asked a question here, it was for my select function. In that question, another user stated the way I did it, might not have been safe. So here I am with the entire class. The class I'm ...
2
votes
1answer
24 views

IPtables for webserver with ssh

I've had a bit of help but I'm still a bit unsure. I have an nginx webserver with SSH only required. I wrote this rule set based on information I found on the internet: ...
3
votes
0answers
46 views

SFTP JSCH security [on hold]

My code below works fine (uploading files to a server directory), but as per my servers rules, I'm required to log in to SFTP using my main server username and password, obviously a little bit of a ...
15
votes
2answers
369 views

Allowing users to input a safe subset of HTML

I am currently working on a project that requires users to input text that may or may not be formatted (if it helps, just think of it as a Stack Exchange clone, even though that's not quite accurate). ...
9
votes
1answer
179 views

Fluent API of a Role based access control implementation

I am trying to provide a fluent API for authorization based on roles. As you will see I separated my implementation in two related Interfaces the Session and the Query. The session provides all roles, ...
3
votes
2answers
127 views
2
votes
1answer
78 views

Checking PHP security on my file

I have created a PHP to change the user's login password: ...
0
votes
0answers
45 views

Script to configure accounts, SSHD, and firewall [closed]

In terms of general security, am I doing anything wrong in this script? ...
8
votes
2answers
96 views

Making a simple session class more secured

I just wrote the session class below. I humbly request for a review on how to make this even more secured/ how sessions are normally written. The code below works, but I would love to make it even ...
1
vote
1answer
61 views

Optimizing Perl script which looks for world-writable files

A script which scans a local filesystem and writes to a file a list of world-writable files found on the filesystem. I ran it on a server with a couple terabytes of storage; not all of it used. In ...
3
votes
3answers
42 views

Keyfile Generator

This is a Java program that generates a random keyfile (for OTP, for example). ...
3
votes
2answers
69 views

Is my PHP code vulnerable to XSS?

Someone says that my PHP code is vulnerable to XSS. I asked them what I should do to fix it, but now they don't want to help. ...
7
votes
2answers
1k views

Is my Java SQL connection secure from hackers?

I would like to know if my java db class is enough protected against hackers. (I'm currently developing an Android application). I protect it with a infos.properties file which contains every ...
2
votes
1answer
78 views

Security of authentication check for a blog

I am currently making a very big blogging system for my Website where I want really neat code! So, I was wondering: is this method safe/does it have any problems with security? Yes, I'll be encrypting ...
5
votes
2answers
101 views

Possible security issues in email validation

I need feedback on this code regarding security issues. ...
6
votes
1answer
66 views

MCRYPT - are there any flaws or areas for improvement in this class?

I am working on a class for encryption to use on my site. I have read through many examples of these functions and would just like to clarify a few points I have read and check if this code is worthy. ...
1
vote
1answer
71 views

Is this PHP mailer file secure from injection attacks?

My PHP contact form was recently being used to send spam. Some security measures have since been put in place (please refer to the comments below) and I'm seeking the collective wisdom of others to ...
6
votes
1answer
84 views

Let OpenSSL decide which TLS protocol version is used by default

I use Gem in a Box, a Ruby project that allows to create personal self-hosted gem repositories. Gem in a Box uses httpclient to connect to the gem repository. After ...
5
votes
2answers
448 views

Password strength checker

I would like to receive feedback about my code. Is there any better way to shorten the code or is it fine? Demo ...
14
votes
1answer
75 views

Sandbox or safely execute eval

In a large project of mine, I've run into a situation where a client might need to run evaluated JavaScript code. I know, it makes me cringe too. One option is to manually parse it, but for future ...
4
votes
1answer
79 views

Implementing HTTP Strict-Transport-Security via MVC action filter

HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this ...
6
votes
1answer
125 views

Is this user login secure?

When it come to security I try to be to better as possible but I don't have the knowledge. According to what I read on-line my following code should be good but I could use some of your ...
4
votes
1answer
41 views

Are there any security problems with this session manager?

I wrote this code to handle logged in users, the session ids will be stored in cookies. I would like to know if it's usable or if there are security problems. It uses a 64bit id and another 64bit ...
5
votes
2answers
100 views

Preventing SQL Injection in user registration routine

At the moment is my code secure for SQL injections and so forth? I still need to hash passwords and make sure fields are valid and so forth. ...
11
votes
3answers
396 views

Pretty way of keeping sensitive info out of a logged command string in Ruby?

I have a long command that I am building with shovels (<<), with the intention of eventually running system(command). I'd ...
-1
votes
1answer
94 views

Is this shopping site safe from SQL injection attacks? [closed]

Please verify security from SQL injection attacks. homepage.php ...