Collaborate Disseminate
I would like to understand which would be the best strategy for authentication between two applications running at different places.
My application client needs to call the Rest API of a server, and there are only few clients… Continue reading How should Two Applications Authenticate between each other
I’m working on a system that needs to use cryptographic functions that must be FIPS 140-2, Level 1 validated. The challenging part is that some of this system needs to run in the browser. For maintainability reasons and ease … Continue reading FIPS 140-2, Level 1 validation vs. compilation
There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of places without seconds thought… Continue reading Validate database column and table names to prevent SQLi?
Without a doubt, if you are on the advertising services side of the Facebook house you’ve been sitting in a kitchen with the oven on broil and all four burners on high—the kitchen is hot. The social network is being viewed by many as culpable in allowi… Continue reading Facebook’s Ad Confirmation Process Won’t Stop the Russians
I need to devise test scenarios to test according to the ISTQB standard (or there abouts). Testing should focus on functional tests such as certificate path validation, ensuring keys are backed up etc.. but not the underlying… Continue reading Testing of a Public key Infrastructure
There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
I am looking for the file name pattern to use it in the input validation.
I need the pattern that prevent me from XSS attacks.
Here I can find one pattern: https://www.owasp.org/index.php/OWASP_Validation_Regex_Repository
During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that application. A different… Continue reading CVSS score for no-input validation
Some web applications (One popular example is Skrill) don’t allow input from Numpad for number <input>.
I’ve seen some local websites here also follow the same procedure.
The thing is, all of them are related to e-com… Continue reading Why would some web applications disable Numpad input?
The Pandora iOS app fails to properly validate SSL certificates provided by HTTPS connections,which may enable an attacker to conduct man-in-the-middle(MITM)attacks. Continue reading VU#342303: Pandora iOS app does not properly validate SSL certificates