This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

1
vote
2answers
29 views

Set-uid root program that runs a program as the user “restrict” (follow-up)

See Set-uid root program that runs a program as the user "restrict" for context. I've written a very short program that is intended to run the program specified in its arguments (...
0
votes
1answer
25 views

Set-uid root program that runs a program as the user “restrict”

I've written a very short program that is intended to run the program specified in its arguments (argv) as the user named "restrict" (which exists). I want to make ...
-4
votes
1answer
38 views

Contact form handler with a honeypot [on hold]

I have created a php contact form and have tried to make it relatively secure. I've added a honeypot field that should be left blank, code to ensure all required fields are filled out and code to ...
1
vote
2answers
85 views

Open server asking for a password

It first creates a server and waits to connect. Once the client connects to the server he gets the line. If he puts the correct code he gets output -> good job. If not -> the software disconnects. My ...
1
vote
1answer
34 views

Creating user accounts while avoid SQL injection attacks

I have a class that creates user accounts and to avoid SQL injection attacks, I am using the following functions to sanitize both the user name and password inputs: ...
4
votes
3answers
150 views

Placing secure data in Java web application

This post is complementary to this one I asked the question about implementing DropBox's "Share link" functionality on the server side in the most "secure" way. Of course, real security involves at ...
6
votes
3answers
1k views

Salt generation in C#

I have designed a small method to generate a salt for a password. All this does is create a random salt and does nothing to add it to the password. I have a few questions regarding my very simple ...
4
votes
1answer
45 views

Hashing a SecureString using Cryptography Next Generation

Goal: I needed to calculate the salted hash of a password, where the password is stored as a SecureString. There doesn't seem to be much .NET framework support for SecureString. In particular, none ...
2
votes
2answers
55 views

Storing customers' orders

I'm developing a shop system and using this method to store the customers with their respective orders: ...
3
votes
2answers
91 views

Inserting a name into a database table

I want to ask you if my PHP code is safe enough. I don't know if I should escape special characters in string after regex validation: ...
3
votes
1answer
80 views

Very simple asymmetric RSA encryption in C#

Based on this: asymmetric encryption in C# I added some more functionality to make it even easier to use (I combined the keySize and the ...
4
votes
1answer
63 views

ASP.net Identity admin reset user password

I have an application which uses ASP.net Identity as for its user authentication. I do not wish for users to reset their own password (for reasons which are not relevant here), so I have developed ...
8
votes
1answer
62 views

Basic registration page and database insertion

Please review my registration code and suggest what changes I should make to improve security. I'm new to PHP and this is my first project. Also I have no Idea how to make a "forget password page" as ...
1
vote
1answer
41 views

URL link SEO and security using Laravel

I'm trying to figure out what the best way to do this is. I have a part on my website where people can search for a particular card based on multiple different factors. Like the name of the card, ...
3
votes
1answer
64 views

CSRF Token implementation

I'm building a website where all data interactions are done over ajax other than the initial page load. Now I discovered the need for CSRF tokens. I elected to deliver the token in a meta tag like ...
2
votes
2answers
64 views

(Part 2) Securing PHP shopping cart (Paytrail integration)

i've developed my shopping cart further. This is related to my earlier post: Securing PHP shopping cart In addition to those functionalities, i've proceeded to make integration to Paytrail payment ...
0
votes
2answers
93 views

Password reset process security

Here is what the reset link looks like that goes in an email to the user: ...
7
votes
2answers
457 views

Securing PHP shopping cart

I've managed to create a working shopping cart and my next concern is security, mostly about the architecture and session security. Should I make sessions somehow secure, if there's no authenticated ...
4
votes
2answers
196 views

Simple Password Utility

I am somewhat new to ruby (but not to programming) and I want to develop a small web-app with Sinatra. I started creating a small password utility script that hashes and secures entered password. I am ...
3
votes
1answer
55 views

Recreating binary counter for arbitrary length arrays

After weeks of slaving over FIPS-197, I finally have my own working C/C# implementation of AES-128 which I'm quite happy about. The next thing I'm looking to do is implement a ...
3
votes
1answer
57 views

Cross-site request forgery defense for code to count Likes

I have the following code which is supposed to insert a row into a DB table "clicks" (consisting of 1 Primary AI column "id" and another column "user" which contains the user's session ID) upon ...
6
votes
1answer
58 views

Adding SecureString support to Lib2GitSharp

A library that I use doesn't support SecureString in its credentials for connecting to GitHub, so I'm submitting a pull request to add it. I know it's not ideal to ...
4
votes
1answer
22 views

Youtube OAuth security

I am working with Youtube OAuth for the first time and I am not that great when it comes to security. I got the following code and would like to hear if you guys can find any security issue: ...
8
votes
1answer
148 views

A rapidly-growing script that visualizes WiFi sniffing

Below is one of the versions of my wifimap script: ...
4
votes
2answers
69 views

Shopping cart login and coupon code validation

I am figuring out how I could make the following query more secure: I have already used mysqli_real_escape_string but I doubt that adds much to security. I have ...
4
votes
2answers
179 views

“Remember me” functionality for a website

I have read a few SO threads to implement remember_me functionality. Steps I have followed: User clicks on login button and if passes client side validation, it goes to php Login page. First time ...
2
votes
1answer
143 views

Console random password generator

This program is a random password generator. It asks the user how many chars they want their password to be and how many passwords it should generate. I used the ...
5
votes
1answer
142 views

SecureString as SqlParameter value without GC concerns

The purpose here is to make it easy to use sensitive data that is already in the form of a SecureString (example) without converting it to a ...
6
votes
1answer
84 views

One way encoding a password

I wrote a script that one way encrypts a user's password by generating a key, and multiplies by the ASCII value of the character and the ASCII value of the key character at (the position that the ...
2
votes
3answers
208 views

A very secure procedural MySQLI login script against injections

I know there are other ways to create a login script like Object Oriented, Prepared Statements and PDO, but how about those old MySQL PHP users like me trying to change from old style to the new ways? ...
2
votes
1answer
89 views

Approach to MVC 4 windows group security to enable/disable controls in view

There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
3
votes
1answer
50 views

MySQL class that handles sanitization

I've written a MySQL class that handles sanitization of different data types. The reason I used this (and not prepared statements) is because this can be more dynamic. Prepared statmenets only ...
2
votes
1answer
46 views

Sanitizing function

This is a sanitizing function. Is this function secure enough? ...
5
votes
1answer
84 views

For a login portal, what security measures are needed to prevent unauthorized access?

I'm designing a login portal that has one angularjs page that displays/processes data queried from a database. I'm relying on a few php pages (a loginpage.php [verifies credentials/loads session ...
2
votes
1answer
151 views

PHP login system security using a database, cookies and sessions

I created a simple login system using just sessions but having to login every time gets annoying. That is why I'm no trying to save the sessions to my database linked to the user's account. I will ...
5
votes
1answer
121 views

Passing a password to a viewmodel

I've got a project I've been working on that connect to a file server and writes some data to a text file. In order to do this I added a textbox for the user to type their username and a passwordbox ...
5
votes
2answers
602 views

Encrypting a string using AES/CBC/PKCS5PADDING

The code below takes a String and encrypts it using AES/CBC/PKCS5PADDING as transformation. I am learning as I go and I have a few questions about my code. Is ...
2
votes
1answer
40 views

PHP CSRF eliminator

There are three functions involved. The first Init is run before the content is parsed. The second is parseContent where the ...
7
votes
3answers
839 views

A Simple, One-Page PHP Admin Login (with prepared SQL statements)

First off, I want mention that this code works well. This is more of a request for suggestions... We're attempting to program a one-page, recursive, token-based admin shell that is safe from ...
14
votes
2answers
547 views

Python-like C string library

Most of the C code I have written has never been seen by anybody else, and I wonder if my code follows normal practices, especially how my code performs security-wise. The code is for a library that I ...
2
votes
1answer
81 views

PHP include page index.php?page=GET safety preg_replace

I found a lot of working codes to include page in page on Internet but I could not find a safe code. So I decided to create one myself. The pages will be only stored in folder /pages/ and whitelist ...
3
votes
2answers
274 views

Getting a local file with file_get_contents

my url is like page.php?path=content/x/y/z/aaa.md. Is the following php code secure? ...
5
votes
3answers
94 views

My lost password function

I'm trying to create a lost password function on my site. When a user enter their email it updates 2 columns in the users table with that email called: ...
2
votes
1answer
341 views

PHP user account login with salt

I'm creating a user account login with PHP and Mysql which will be used by school teachers. To login there are 3 items required : school, username and password. This will allow for 2 of "MRSMITH" in ...
3
votes
2answers
113 views

PHP contact form

I recently had my site hacked, with the main index file being overwritten (nothing else was touched). I'm assuming they hijacked my form input. Are there any vulnerabilities in the code or does this ...
1
vote
0answers
29 views

Persisting database row ID between controller actions on a multi-step “create item” form

I have a form on an anonymous site which has 3 steps. A user submits each step individually, in sequence (1-2-3). BUT, step 1 creates a new table row, while steps 2 and 3 only update the existing row ...
3
votes
3answers
200 views

PDO class and security

I have started a project in PHP with PDO and I'm almost done, but I've read somewhere that PDO escape alone is not secure and we have to consider some settings of PDP. I am a little confused about my ...
2
votes
2answers
133 views

Contact Form Sanitized Inputs

I have the following as my Ajax / PHP contact form on a site I am building. I have sanitized the inputs but just wanted to make sure I havent missed anything... ...
7
votes
2answers
732 views

Preventing SQL injection by converting all characters to their ASCII values

Scenario In order to prevent SQL injection, I'm converting every character of a string to be inserted in the database into its ASCII value before performing the query; in order to read the value of ...
4
votes
3answers
43 views

Security feedback sought on Perl code running command on unsafe filename in Unix env

I'm looking for security feedback on the following fully functional code. The code is trying to safely use the Unix 'file' command to give details about the file. A hard link is used to create a ...