This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

3
votes
1answer
35 views

BouncyCastle Rijndael 256 Implementation

I modified the implementation from this website to include a salt: ...
5
votes
2answers
197 views

Database Handler Class

I've written this DB Handler class. Please review it and suggest any code edits or point out mistakes and security loop holes. Please also suggest a better way to handle things, if there is a security ...
0
votes
0answers
24 views

Prevent client-side tampering of disabled fields in ASP.NET [on hold]

We're using ASP.NET WebForms. Sometimes, due to varying business rules, a user might have permission to edit some, but not all of the data. Typically, we'll just disable any ReadOnly fields so the ...
-2
votes
0answers
44 views

Which Encryption Code is More Secure? [closed]

I have made some C# code for encryption and decryption that converts whole files to one huge byte[] not blocks so after scouring the internet i found a few code samples that do the encryption in ...
0
votes
0answers
32 views

Decrease file size of encrypted file

I am making a Cryptography application and I noticed that the encrypted file is approximately 2 times bigger because I am encoding the files in base64. Are there any file encodings that take less ...
3
votes
1answer
33 views

CLI Command Search Tool - XML Framework

I'm working on the OSCP, and Information Security certificate based around penetration testing. CLI-based tools seem to be the core of most pen-testing assignments, so I'd like to build a tool aiding ...
11
votes
2answers
970 views

Is this safe against major XSS attacks?

I am building a classifieds website here in Portugal, and I'm now in the security phase. So until now, I already made what I think is a good measure against SQL injection: ...
5
votes
1answer
60 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
12
votes
3answers
506 views

Security issues in a SQL query and possible function?

By adding more and more features to my websites, I am now up to 7 different hard coded queries. I have read a lot about SQL injections and possible flaws and security issues, and wanted to make ...
0
votes
1answer
48 views

256 bit AES encryption in Android

I am using the following code to encrypt a file in an SD card in Android: I want the code to be reviewed for: Security (prioritize this) Coding Style Performance ...
4
votes
6answers
275 views

Login function in PHP

I've been working on a simple login script. The registration part is still to be coded, but I'm done the login part. Are there any security holes in my code? I'm using SHA-512 right now but I think ...
12
votes
5answers
2k views

PHP mail form is being abused

I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail ...
4
votes
2answers
82 views

PHP and MySQLi login script - is it secure / am I doing something wrong?

Below is the code for my login page. I haven't really used MySQL (especially OOP) before, so I'd like to know if I'm doing something inherently wrong. The code is working as expected, but I don't ...
12
votes
1answer
152 views

Cryptographically-secure super-secret government message transaction machine

-Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? ...
0
votes
0answers
17 views

Security risk stemming from data passed in $_GET superglobal [migrated]

This is a short but general question. I am relatively new to programming in general. My site,w which is predominately written in PHP, will be launched soon and is undergoing some security tightening. ...
4
votes
0answers
52 views

Java secured cookie - security issues?

I tested the play framework the last days and had mixed feelings about it. In the end, I don't use play for my new REST project. I use http://www.sparkjava.com as minimal server setup. But I really ...
17
votes
3answers
1k views

How is my CMS design? Any security, design, or other issues?

I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can... The way I am trying to design this CMS is to keep including 'modules' within a page ...
5
votes
1answer
49 views

Clarity of encryption class

I have recently gotten back into development and I am wondering if the script I have just created is clearly documented and easily understandable throughout each step. Is it easy to understand? ...
3
votes
1answer
43 views

Login system, PDO and me - Part 2

This is a follow up question to: Login system, PDO and me Is this considered secure for a login script? ...
6
votes
1answer
73 views

Secure password-hashing in Java

Here is an article on password hashing, along with an implementation. Is this code secure with number of iterations 10000, key length 256 and salt bytes 32? Is there a rule-of-thumb for key ...
7
votes
2answers
504 views

Protect database from SQL Injection and similar attacks - PHP

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
2
votes
0answers
31 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...
4
votes
0answers
86 views

Password-hashing method in Java [closed]

There is an article on Crackstation where they show you how to hash a password correctly. I've implemented the Java version of it which is working fine, but is the method they use secure? ...
6
votes
3answers
312 views

Functions to escape CSS rules in PHP

Some context I've been tasked with supplying an escaping function to arbitrary CSS values that are entered through a form. The goals and caveats are: I know it's bad practice to let users input ...
4
votes
1answer
125 views

Preventing session hijacking

I'm implementing a login script and I want it to be more secure: ...
4
votes
2answers
174 views

Updating necessary data using just one function

My objective is to update necessary data using one function instead of having different functions to update different fields. So, I've created one and I think this is not really elegant, efficient or ...
1
vote
3answers
126 views

Security of code snippets

Last time I made a website using PHP, I didn't know of PDO, so someone dropped all my tables. I think I've made an improvement now. I'm sorry if there's a lot to go through, but I want to make sure ...
4
votes
1answer
45 views

Simple file downloader

On my website I want to offer some PDFs, ZIP files and images for download. They are all in the same folder and I could simply link to them like ...
2
votes
1answer
54 views

Login System Security Part 2

Old code: Login system security This is an update on the code and suggestions I received from generous users on the old thread. So same rules apply, just check it out, tell me what you think. Is ...
7
votes
4answers
495 views

Is this PHP code snippet safe?

Mostly asking for critiques of vulnerability. Am I using any functions or methods that are unsafe? ...
2
votes
2answers
82 views

Preg_match pattern for user input filtering

My users may need to supply a 'disease category' to my site. I need to let them use all alphanumeric characters, hyphens and single quotes. Would someone review this to see if they feel it's ...
2
votes
1answer
49 views

Is this `img` creator decently secure from XSS?

This is being used now, seems decent to me but I'm curious. ...
4
votes
1answer
120 views

Login system security

Here is a login system I am working on. I just want an opinion on it and whether I am going in the right direction or am just completely missing something. The main thing I would like to know is: am ...
3
votes
1answer
70 views

How to regenerate my session ID often when using this class?

I have created a class that will manage my session. I am hoping to acomplish a class that will secure my site from all known attacks (ie. fixation, precedent, and capture.) The idea is to Change ...
2
votes
2answers
58 views

String sanitisation function

I have a search function on my website. In addition, elsewhere I have a place where users can submit categories for their posts. I want the categories to have an uppercase first letter and the rest ...
2
votes
1answer
112 views

SQL injection security

I wanted to know if this code is safe against SQL injection or not? Also do I need to mysqli_close if I already did the ...
1
vote
2answers
67 views

Controlling permissions in a MVP application

In a Windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as ...
4
votes
1answer
62 views

Entire PDO DB Class

Last time I asked a question here, it was for my select function. In that question, another user stated the way I did it, might not have been safe. So here I am with the entire class. The class I'm ...
2
votes
1answer
25 views

IPtables for webserver with ssh

I've had a bit of help but I'm still a bit unsure. I have an nginx webserver with SSH only required. I wrote this rule set based on information I found on the internet: ...
3
votes
0answers
55 views

SFTP JSCH security [closed]

My code below works fine (uploading files to a server directory), but as per my servers rules, I'm required to log in to SFTP using my main server username and password, obviously a little bit of a ...
15
votes
2answers
382 views

Allowing users to input a safe subset of HTML

I am currently working on a project that requires users to input text that may or may not be formatted (if it helps, just think of it as a Stack Exchange clone, even though that's not quite accurate). ...
10
votes
1answer
240 views

Fluent API of a Role based access control implementation

I am trying to provide a fluent API for authorization based on roles. As you will see I separated my implementation in two related Interfaces the Session and the Query. The session provides all roles, ...
3
votes
2answers
131 views
2
votes
1answer
81 views

Checking PHP security on my file

I have created a PHP to change the user's login password: ...
8
votes
2answers
104 views

Making a simple session class more secured

I just wrote the session class below. I humbly request for a review on how to make this even more secured/ how sessions are normally written. The code below works, but I would love to make it even ...
1
vote
1answer
70 views

Optimizing Perl script which looks for world-writable files

A script which scans a local filesystem and writes to a file a list of world-writable files found on the filesystem. I ran it on a server with a couple terabytes of storage; not all of it used. In ...
3
votes
3answers
45 views

Keyfile Generator

This is a Java program that generates a random keyfile (for OTP, for example). ...
3
votes
2answers
74 views

Is my PHP code vulnerable to XSS?

Someone says that my PHP code is vulnerable to XSS. I asked them what I should do to fix it, but now they don't want to help. ...
7
votes
2answers
1k views

Is my Java SQL connection secure from hackers?

I would like to know if my java db class is enough protected against hackers. (I'm currently developing an Android application). I protect it with a infos.properties file which contains every ...
2
votes
1answer
79 views

Security of authentication check for a blog

I am currently making a very big blogging system for my Website where I want really neat code! So, I was wondering: is this method safe/does it have any problems with security? Yes, I'll be encrypting ...