Collaborate Disseminate
I am interested in standardizations for secure design and development of products, especially towards operational technology / IoT / ICS. My understanding of information security management systems via the ISO 27XXX and country-specific st… Continue reading Standards for Secure Products
I am familiar with web security but I would like to know more about non-web application security.
I know about memory corruption vulnerabilities like buffer overflow and buffer overread and how serious they are. But how about Java/C# or si… Continue reading Learning Desktop Application Security
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the violation of the CSP directive when trying t… Continue reading CSP script-scr blob
I’m trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or application layer)? I found Tree Based Group … Continue reading Is Message Layer Security the state of art protocol for group encryption? [migrated]
Tel Aviv startup scores investment to build technology to secure in-house low-code/no-code custom applications.
The post Nokod Snags $8M to Secure Low Code/No-Code Custom Apps appeared first on SecurityWeek.
Continue reading Nokod Snags $8M to Secure Low Code/No-Code Custom Apps
When I sent a request such as:
GET /500.aspx?aspxerrorpath=/error.aspx HTTP/1.1
Host: test.com
Burp reports "The application may be vulnerable to DOM-based open redirection:
Data is read from document.location.pathname and passed to … Continue reading Burp DOM-based Open Redirect
public native boolean aaa(String str, AssetManager assetManager);
static {
System.loadLibrary("app");
}
/* access modifiers changed from: protected */
public void onCreate(Bundle savedInstanceState) {
super.onCreate(sav… Continue reading I have a CTF challenge for an Android app, How I extract the flag [closed]
I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update signatures. For this, the process needs t… Continue reading Strategy for storing private keys used in an embedded device
I have a record in splunk that contains some data that I need to act on.
I have a record the looks like this
{ [-]
…
stages: [ [-]
…
{ [+]
}
…
{
name:Build and publish
children [
{ [-]
arguments: set… Continue reading SPATH with JSON in splunk [migrated]
I’ve been working long time on a web application, consisting of a large amount of data and many services and also communicating with external services.
Now that I’m very happy with the functionality and reliability, before moving from an … Continue reading Planing the security for a public web application, any feedback?