Category Archives: Application Security

Python Pickle Security Issues / Risk

May 31, 2024 by Ajitesh Kumar · Leave a comment
Python Pickle Security Issue Risk Vulnerabilities

Suppose your machine learning model is serialized as a Python pickle file and later loaded for making predictions. In that case, you need to be aware of security risks/issues associated with loading the Python Pickle file. Security Issue related to Python Pickle The Python pickle module is a powerful tool for serializing and deserializing Python object structures. However, its very power is also what makes it a potential security risk. When data is “pickled,” it is converted into a byte stream that can be written to a file or transmitted over a network. “Unpickling” this data reconstructs the original object in memory. The danger lies in the fact that unpickling …

Continue reading →

Posted in Application Security, Machine Learning, Python. Tagged with , .

Security Misconfiguration Example – Upwork

July 7, 2020 by Ajitesh Kumar · Leave a comment
OWASP Security Misconfiguration Example

In this post, you will see an example of security misconfiguration which is one of the top 10 security vulnerabilities as per OWASP top 10 security vulnerabilities. Here is what security misconfiguration means? Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc to gain unauthorized access or knowledge of the system. In this post, you will see the example of unauthorized knowledge of the system. Security Misconfiguration Example This morning, I was checking the Upwork.com when I saw this message when I tried to login. Take a look at exceptions and stack trace. Using the above, I could extract some …

Continue reading →

Posted in Application Security. Tagged with , .

Javascript Security Vulnerabilities Examples (DarwinBox)

November 21, 2018 by Ajitesh Kumar · Leave a comment

In this post, you will learn quick tips on security vulnerabilities related to Javascript based on analysis of how Javascript assets are managed in DarwinBox, and how to fix those security vulnerabilities. Security Vulnerabilities found with Javascript Assets While assessing the Javascript assets of DarwinBox, the following was found: Coding: Javascript code could be easily read and understood. There is a need to minimize and uglify the code. Method naming: The name of methods leak the implementation details and the underlying technology used. This could be used by hackers for planning attacks. For example, the method such as “doElasticSearch”. This represents that ElasticSearch is used for the search. File naming: The name of files represented …

Continue reading →

Posted in Application Security, Javascript, Web. Tagged with , .

How-to Tutorials for Spring Security OAuth2 & REST API

March 18, 2018 by Ajitesh Kumar · Leave a comment
spring security oauth2 and rest api

In this post, I have listed down some of the top pages which I came across while doing exploring implementation for Spring Security OAuth2 for REST APIs based apps. This page will be updated with good links in time. Secure a Spring Boot REST API With JSON Web Token + Reference to Angular Integration This one is very helpful (by-far-the-best) for developers doing Angular App on the client side and Spring Boot app on the server side. Really a great step-by-step tutorial. Kudos to Author, Nouhoun Y. Diarra. Covers some of the following topics. Github project can be found on this page. Configure spring security Configure authorization server Configure resource server …

Continue reading →

Posted in Application Security, Java. Tagged with , , .

Security Lessons from OnePlus Hacking & Credit Card being Stolen

January 20, 2018 by Ajitesh Kumar · 1 Comment
Oneplus Store Checkout Page

OnePlus Store Website recently got discovered to be hacked as a result of which credit card details of more than 40,000 customers have been stolen. In this post, you will learn about somee of the following: How the attack might have happened on/from OnePlus Checkout page? Who could be the hackers? How to prevent such attacks? Malicious Code Injection may have resulted into Hack Hacker might have hacked into the OnePlus website and injected malicious Javascript code in one of their javascript files which get loaded as a result of loading of checkout page. The following represent the screenshot of checkout page which is loaded from Onestore website. Look at …

Continue reading →

Posted in Application Security, Javascript, Web. Tagged with .

Angular – How to Prevent XSS Attacks – Code Examples

January 3, 2018 by Ajitesh Kumar · Leave a comment
How to prevent XSS attack in Angular App

This article represents concepts and related instructions, code example/sample in relation to Cross-site scripting (XSS) security vulnerabilities in Angular app and how to prevent XSS attacks. This instruction in this article is valid for Angular 5.* and Angular 4.* versions. Before we get started, read the related details on XSS on this page, Top 10 Angular security Best Practices. This article will look into some of the following details in relation to XSS vulnerability and how attacks due to XSS can be prevented using Angular out-of-the-box utilities. What is Cross-site Scripting (XSS) Attack? Different types of XSS Vulnerabilities Angular approach to prevent XSS attacks Angular recommendations to prevent Server XSS …

Continue reading →

Posted in AngularJS, Application Security, Javascript, Tutorials, Web. Tagged with , , .

Angular – Top 10 Security Best Practices vis-a-vis Security Risks

December 23, 2017 by Ajitesh Kumar · Leave a comment
angular security best practices

Are you concerned about security vulnerabilities in your angular app? Have you been wondering whether one or more of your angular apps are at security risks? Your worries regarding potential security bugs in your angular apps are well justified given security threats to web apps in general. This article would help you learn some of the top security best practices for your Angular apps. Some of these best practices may as well be applied for earlier versions of AngularJS. We shall be referring the security best practices in relation to some of the OWASP Top 10 Security Vulnerabilities. Some of the recommendations include out-of-box support from Angular Http utility such as DomSanitizer and HttpClient which is part of Angular 2, Angular 4 and Angular 5. Quick Recall …

Continue reading →

Posted in AngularJS, Application Security, UI, Web. Tagged with , , , .

OWASP 2017 Top 10 Web App Security Vulnerabilities

November 24, 2017 by Ajitesh Kumar · Leave a comment
OWASP Top 10 2017 Security Vulnerabilities

The following is a list of web application security vulnerabilities which made into the list of OWASP 2017 top 10 security vulnerabilities. Injection: Injection attack can lead to commands such as SQL, NoSQL, OS, LDAP executed by the related command interpretor resulting into execution of unintended commands thereby modifying the datasets or providing unauthorized access to the data. Broken authentication: Broken authentication attacks can lead to compromising passwords, keys or session tokens etc. Sensitive data exposure: Sensitive data exposure vulnerability would allow attackers to get an access to sensitive data such as identity related data (email address, mobile numbers), credit card related details etc. These data can be obtained from …

Continue reading →

Posted in Application Security. Tagged with .

Application Security – Use NPM Request Package for APIs Access

September 14, 2017 by Ajitesh Kumar · Leave a comment

This blog represents code sample and related details that can be used to hack into the system through unprotected APIs. The security vulnerability such as following can be exploited using the code sample given later in this article. Note that the security vulnerabilities mentioned below forms part of OWASP 2017 Top 10 security vulnerabilities. Insufficient attack protection Sensitive data exposure Unprotected APIs The code below has made use of NPM request package to send the request to the API hosted ast Paytm Catalog Site. The API below displays electronics items listed on PayTMMall.com. Put the code shown above in a file, say, test.js and execute the file using command such as …

Continue reading →

Posted in Application Security, Javascript. Tagged with , , .

Dummies Notes – How SAML-based SSO Authentication Works?

May 20, 2015 by Ajitesh Kumar · 1 Comment

This article represents dummies notes on how could one go for SSO implementation using SAML. Please feel free to comment/suggest if I missed to mention one or more important points. Also, sorry for the typos. Following are the key points described later in this article: What is SAML? How does SSO authentication happen using SAML? What are Key Components of SSO Design, in general?   What is SAML? For those of you unaware of what is SAML, here is the definition from WIKIPedia page on SAML: Security Assertion Markup Language (SAML, pronounced sam-el[1]) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, between …

Continue reading →

Posted in Application Security, Software Engg. Tagged with .

AngularJS – How to Handle XSS Vulnerability Scenarios

November 25, 2014 by Ajitesh Kumar · Leave a comment

This article represents different scenarios related with XSS (cross-site scripting) and how to handle them appropriately using AngularJS features such as SCE ($sceProvider) and sanitize service ($SanitizeProvider). Please feel free to comment/suggest if I missed to mention one or more important points. Also, sorry for the typos. Do visit the page, how to prevent XSS attacks in Angular 2.*, Angular 4.* or Angular 5.*, if you are looking forward for handling XSS vulnerabilities in latest version of Angular apps. You may also want to check the page, Top 10 Angular Security Best Practices vis-a-vis vulnerability issues. Following are the key XSS-related scenarios described later in this article: Escape HTML completely …

Continue reading →

Posted in Application Security, Javascript, Web. Tagged with , , , .

Authentication using One Time Password (OTP) technique – Part 1

September 22, 2014 by Ankesh Anupam · 5 Comments

This gallery contains 3 photos.

Why two factor authentication? With the increase in password theft, phishing attacks and other hacking techniques, the conventional text based user name and password based authentication seem to be insufficient because of the rapid rise of network level threats. The traditional way of just memorizing the password to validate one’s identity is not enough and web sites and applications are now expecting one to possess email Id or a smartphone to communicate with another short-lived randomized password, One Time Password (OTP), as one more factor to the authentication. Here we will discuss the approach to generate the OTP and use it for the two factor authentication technique. In the next …

Continue reading →

More Galleries | 5 Comments

Java – 4 Security Vulnerabilities Related Coding Practices to Avoid

September 18, 2014 by Ajitesh Kumar · 1 Comment

This article represents top 4 security vulnerabilities related coding practice to avoid while you are programming with Java language. Recently, I came across few Java projects where these instances were found. Please feel free to comment/suggest if I missed to mention one or more important points. Also, sorry for the typos. Following are the key points described later in this article: Executing a dynamically generated SQL statement Directly writing an Http Parameter to Servlet output Creating an SQL PreparedStatement from dynamic string Array is stored directly Executing a Dynamically Generated SQL Statement This is most common of all. One can find mention of this vulenrability at several places. As a …

Continue reading →

Posted in Application Security.

OWASP Broken Authentication and Session Management Example

June 24, 2014 by Ajitesh Kumar · 2 Comments

The article presents an example on one of the top OWASP vulnerability related with authentication and session management. This is termed as “Broken Authentication and Session Management”. To know more about this vulnerability and related details, visit OWASP page for broken authentication and session management.   I was surfing a website, http://www.99acres.com, few days back and tried to retrieve my password using “Forgot Password” page. As I entered my username, I was amazed to see my email address shown there. I, then, tried another name such as “karthik” and following was the message:“An email has been sent to karthiksundaram@gmail.com. Please click on the link provided in the email to create …

Continue reading →

Posted in Application Security. Tagged with .

OWASP Security Misconfiguration Example – Infosys Career Website

April 5, 2014 by Ajitesh Kumar · Leave a comment

The article presents an example of “Security Misconfiguration” vulnerability that was found on Infosys career website. It could be noted that security misconfiguration is considered as one of the OWASP top 10 security vulnerabilities. The vulnerability was found with Careers web application of Infosys, which can be accessed at https://careers.infosys.com/. As you access the career site link, you would see the title icon as “SAP”. This does suggest that Infosys careers web application is created on top of SAP career module. The way I found that is following: Go to job opportunities page. Click on “Register”. You would land on the registration page with following link: https://careers.infosys.com/sap/bc/webdynpro/sap/hrrcf_a_candidate_registration Go ahead and strip the hrrcf_a_candidate_registration from …

Continue reading →

Posted in Application Security. Tagged with , .

OAuth Explained with Google OAuth 2.0 Playground

March 18, 2014 by Ajitesh Kumar · Leave a comment

The article represents concepts around OAuth based authentication with help of Google OAuth 2.0 Playground, Thanks to Google! Google OAuth 2.0 playground could be accessed at https://developers.google.com/oauthplayground/ . It may be recommended to check the article on OAuth Authentication in order to understand the OAuth with the help of OAuth playground in a much better fashion. Google OAuth 2.0 Playground is a Google application put out there on the web for users to achieve some of the following objectives: Work with various different Google APIs and study/understand API feed data in form of request/response (JSON response). Understand OAuth based authentication and underlying technology consisting of concepts such as authorization code, authorization, request/refresh tokens etc. In …

Continue reading →

Posted in Application Security. Tagged with , .
123next →