Security relative to source-code edition, protection and management.
1
vote
2answers
105 views
Tools to extract code comments from sites?
I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
3
votes
4answers
182 views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
1
vote
2answers
63 views
VCS to manipulate returned trees to prevent leaks? [closed]
I am wondering if there is any system that would change source code trees in subtle from version control systems in ways that are hard to discover (i.e. whitespaces at the ends of lines, perhaps even ...
2
votes
2answers
77 views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
5
votes
2answers
118 views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
7
votes
4answers
662 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
3
votes
2answers
159 views
Can a virus infect source code files with dangerous data?
If a user was infected with a file altering virus is it possible that checked in code (files containing text) to the source control could contain dangerous properties.
I ask this after this got me ...
5
votes
4answers
260 views
Source code auditing and fake builds
I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain.
Say I would be a dishonest programmer that would wish to put in some backdoor into ...
4
votes
3answers
949 views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
-1
votes
1answer
101 views
How to prevent code injection like automatically adding extra character? [closed]
Code:
$result = "Hello World";
$jsonEncodeValue = $result;
echo $jsonEncodedValue;
Assumed Output:
"Hello World"
Real Output:
\n"Hello World"
This \n Line Feed added automatically.
For this ...
69
votes
7answers
3k views
How do I know a piece of software only does what the author claims?
Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
2
votes
1answer
505 views
Is there any decompiled source code for the “Flame”/“Skywiper” malware?
When searching for the source for Stuxnet, its relatively easy to come by in one form or another. Although I'm actually curious if anyone has done any work to comment the source and perhaps clean up ...
10
votes
5answers
409 views
Does naming sensitive things discreetly provide protection?
I had a job where a manager said he liked naming servers after places because if they were named descriptively e.g. "passwords database server" they become obvious targets. I sort of generalized this ...
8
votes
4answers
399 views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
5
votes
1answer
160 views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
7
votes
7answers
205 views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
-2
votes
1answer
372 views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
1
vote
2answers
393 views
Are there any free static analysis tools for C# / .NET code
A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
0
votes
0answers
104 views
Examples of vulnerabilities being changed in only one (of many) places [closed]
I'm looking into source code analysis and was wondering if folks know of examples, in open source projects, of vulnerabilities where there were multiple "very similar" vulnerabilities in the same ...
0
votes
3answers
252 views
What reputable site should I download Putty from?
I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.
If you needed to download Putty for a high security Windows ...
3
votes
2answers
243 views
Tools for analyzing Perl 5 code?
I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
8
votes
3answers
682 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
4
votes
6answers
374 views
Could a computer program be used to automate testing for trapdoors?
Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
5
votes
1answer
523 views
Average number of exploitable bugs per thousand lines of code?
Over the years I've heard various estimates for the average number of exploitable bugs per thousand lines of code, a common figure being one exploitable bug per thousand lines of code. A Google search ...
1
vote
2answers
183 views
Is the following code vulnerable? [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = ...
2
votes
2answers
298 views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
0
votes
1answer
100 views
Which software scans software for potential vulnerabilities?
Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
0
votes
4answers
566 views
Writing file shredder
I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that?
(1) Open the file with
...
8
votes
4answers
532 views
Source code security
We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS).
...
6
votes
2answers
270 views
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
2
votes
2answers
118 views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
2
votes
3answers
222 views
Securing dropdown boxes
I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured.
...
1
vote
0answers
3k views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
7
votes
2answers
215 views
Should I store my intellectual property / code online?
As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much ...
3
votes
2answers
644 views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
-4
votes
1answer
219 views
How do I secure my source code of my teamwork? [closed]
I have a teamwork, and I have to secure source code. I think about SVN, but i don't know is it secure?
6
votes
7answers
5k views
Programming language for network security
I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
4
votes
4answers
2k views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
5
votes
1answer
315 views
question for pentesters: PHP proc_open() in safe_mode
Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?
As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
0
votes
2answers
363 views
TimThumb security alternative or fix?
"An image resizing utility called timthumb.php is widely used by many WordPress themes....The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code ...
3
votes
3answers
254 views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: ...
0
votes
1answer
391 views
can the value of request.getHeader(“Host”) be faked?
Suppose if there is some code like
<a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a>
Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
6
votes
1answer
484 views
Is Request.getHeader(“host”) vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
1
vote
2answers
507 views
how an iframe can cause xsrf?
I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
4
votes
1answer
370 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
1
vote
1answer
274 views
Is there any way to use Nuget securely?
Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"
The problem I have is that anyone can pretend to be ...
4
votes
3answers
1k views
What programming language is Stuxnet written in?
I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?
Is the source code for Stuxnet available anywhere?
1
vote
2answers
762 views
Is it possible to encrypt your Java source code and still have it readable & writable in Eclipse?
I have some Java source code on my laptop that would cause me a great deal of suffering if I were to lose possession of the laptop and the source code were to fall into someone else's hands.
Is there ...
4
votes
2answers
162 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
10
votes
2answers
191 views
security implications of NULL dereference
Suppose we have code like this:
struct somedata {
int a;
int b;
};
struct somedata *data;
/* ... */
data = malloc(sizeof(struct somedata));
data->a = something;
Now, as you can see, NULL ...
