You don’t want to specify PKCS#7 padding for block cipher use. You want to specify PKCS#5 padding. PKCS#5 is specified for use with block ciphers while PKCS#7 is not (it’s use for different places like in S/MIME). I will point out that PKCS#5 and PKCS#7 actually specify exactly the same type of padding (they are … Read more
HTTPS is not replayable, the first server response in the handshake sequence includes a server-chosen random number. What Fiddler does is act as a proxy, meaning it intercepts your browser’s requests, and then generates an identical request to the server, meaning it has access to the plaintext, which is what it will be replaying. Your … Read more
I released a free anti-malware app for Android, and making sure nobody hacked it was essential to its success. The biggest threats agains an app on the Android Market include leaked source code, copied/distributed paid apps, and re-keying. I explain each below and way to solve them. Firstly, this paper describes how to reverse-engineer an … Read more
The attacker has no way to get the token. Therefore the requests won’t take any effect. I recommend this post from Gnucitizen. It has a pretty decent CSRF explanation: http://www.gnucitizen.org/blog/csrf-demystified/
Allow only authorized users to upload a file. You can add a captcha as well to hinder primitive bots. First of all, set the MAX_FILE_SIZE in your upload form, and set the maximum file size and count on the server as well. ini_set(‘post_max_size’, ’40M’); //or bigger by multiple files ini_set(‘upload_max_filesize’, ’40M’); ini_set(‘max_file_uploads’, 10); Do size … Read more
PHP has a configuration directive intended exactly for that, called display_errors. Like any other configuration setting, it’s best to be set in php.ini. But in case you don’t have access to this file, you can set it right in PHP code to Hide All Errors: ini_set(‘display_errors’, 0); to Show All Errors: ini_set(‘display_errors’, 1); While ERROR_REPORTING … Read more
If you use basicHttpBinding, configure the endpoint security to “None” and transport clientCredintialType to “None.” <bindings> <basicHttpBinding> <binding name=”MyBasicHttpBinding”> <security mode=”None”> <transport clientCredentialType=”None” /> </security> </binding> </basicHttpBinding> </bindings> <services> <service behaviorConfiguration=”MyServiceBehavior” name=”MyService”> <endpoint binding=”basicHttpBinding” bindingConfiguration=”MyBasicHttpBinding” name=”basicEndPoint” contract=”IMyService” /> </service> Also, make sure the directory Authentication Methods in IIS to Enable Anonymous access
In case you are in need of knowing how to extract this information from the certificate in your iOS code, here you have one way to do it. First of all add the security framework. #import <Security/Security.h> The add the openssl libraries. You can download them from https://github.com/st3fan/ios-openssl #import <openssl/x509.h> The NSURLConnectionDelegate Protocol allows you … Read more
CSRF protection comes in a number of methods. The traditional way (the “Synchronizer token” pattern) usually involves setting a unique valid Token value for each request and then verifying that unique value when the request is subsequently sent in. It is usually done by setting a hidden form field. The token value is usually short … Read more
Knowing the structure of your filesystem might allow hackers to execute directory traversal attacks if your site is vulnerable to them. I think exposing phpinfo() on its own isn’t necessarily a risk, but in combination with another vulnerability could lead to your site becoming compromised. Obviously, the less specific info hackers have about your system, … Read more