Category Archives: appsec

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

Posted on by

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if after logging into that first site (wh… Continue reading Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe→

Can android apps be developed to allow users select what Fingerprint out of the multiple stored on the phone to use for authentication? [migrated]

Posted on by

A client recently added fingerprint authentication as an alternative form of signing in to their application which stores sensitive data.
Of course, the username and password are verified before allowing fingerprint authentication.
But thi… Continue reading Can android apps be developed to allow users select what Fingerprint out of the multiple stored on the phone to use for authentication? [migrated]→

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Posted on by

Here’s our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration files when the app was created.
We now … Continue reading I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?→

IAST, IaC, Secrets: A Guide to App Sec Tools

Posted on by

Image by S. Hermann & F. Richter from Pixabay
We covered several acronyms common in application security in a previous post: SAST, DAST, and SCA. We’ll continue our discussion on AppSec concepts today by focusing on IAST, IaC, and secrets.
Interact… Continue reading IAST, IaC, Secrets: A Guide to App Sec Tools→

FlyTrap Android Trojan Snares Victims

Posted on by

Logging in to the right domain doesn’t always guarantee security, something users don’t always seem to realize, according to researchers at Zimperium zLabs. Over the last six months, the researchers detailed multiple instances of a new Android Trojan,… Continue reading FlyTrap Android Trojan Snares Victims→

Four best-practices for introducing new application security standards to secure APIs

Posted on by

This article is the second in a three part series focused on application security in the API-first era. The articles summarize a 3-part executive series in which leading global security and technology executives discussed how their organizations … Continue reading Four best-practices for introducing new application security standards to secure APIs→