title,body,link,tags,view_count,is_answered,score,answer_count
Mobile app security testing using OWASP ZAP,"<p>I want to perform the security testing of a mobile application that is installed on my mobile (basically installed the apk of the application). The setup is all done. And if I load any web application ZAP is recording all the calls done via mobile. But when I open the application and perform any action the page is just showing the loading icon but data is not displaying or nothing is recorded in the ZAP application also. Can anyone please help me to do mobile application security testing in the android device using the ZAP tool.</p>
",https://stackoverflow.com/questions/62916973/mobile-app-security-testing-using-owasp-zap,"['security', 'apk', 'mobile-application', 'zap']",3950,False,1,1
Spring REST Security Testing - Cross Origin Issue,"<p>I am working on Spring Boot and Spring Rest application. The Security Testing have reported the issue </p>

<blockquote>
  <p>""The web application or services inform web client of the allowed domain using the HTTP response header Access-Control-Allow-Origin. The header can contain a '*' to indicate that all domain are allowed.""</p>
</blockquote>

<p>Remediation - </p>

<blockquote>
  <p>Use the Access-Control-Allow-Origin header only on chosen URLs that need to be accessed cross-domain. Don't use the header for the whole domain.</p>
</blockquote>

<p>While making the HTTP request, they've used <code>origin: null</code>, then <code>Access-Control-Allow-Origin: *</code> </p>

<p>How can I implement this?</p>
",https://stackoverflow.com/questions/61210074/spring-rest-security-testing-cross-origin-issue,"['cross-domain', 'spring-rest', 'cross-origin-read-blocking', 'security-testing']",86,True,0,1
How can we integrate Owasp ZAP &amp; Cypress?,"<p>Is there any way we can integrate Owasp Zap security testing tool with Cypress?</p>
",https://stackoverflow.com/questions/62164249/how-can-we-integrate-owasp-zap-cypress,"['automation', 'cypress', 'owasp', 'zap']",1646,False,3,1
Mobile app security testing using OWASP ZAP,"<p>I want to perform the security testing of a mobile application that is installed on my mobile (basically installed the apk of the application). The setup is all done. And if I load any web application ZAP is recording all the calls done via mobile. But when I open the application and perform any action the page is just showing the loading icon but data is not displaying or nothing is recorded in the ZAP application also. Can anyone please help me to do mobile application security testing in the android device using the ZAP tool.</p>
",https://stackoverflow.com/questions/62916973/mobile-app-security-testing-using-owasp-zap,"['security', 'apk', 'mobile-application', 'zap']",3950,False,1,1
Oracle Apex 20.1 automated testing,"<p>Is there available any tool or framework for automated security testing of Oracle Apex 20.1 application?</p>
<p>I found Apex-sert but as the README on their github page says it supports only older versions.</p>
<p><a href=""https://github.com/OraOpenSource/apex-sert"" rel=""nofollow noreferrer"">https://github.com/OraOpenSource/apex-sert</a></p>
",https://stackoverflow.com/questions/63594106/oracle-apex-20-1-automated-testing,"['oracle', 'oracle-apex']",507,True,3,4
xml xpath and nesting in python,"<p>Im trying to print out the description within <code>.//statement/statement/description</code> which would be the following statements </p>

<blockquote>
  <p>"" Implements a process for ensuring that organizational plans for
  conducting security testing, training, and monitoring activities
  associated with organizational information systems:"" </p>
  
  <p>""Reviews testing, training, and monitoring plans for consistency with
  the organizational risk management strategy and organization-wide
  priorities for risk response actions.""</p>
</blockquote>

<p>but for some reason it also drills deeper and prints out the following two statement as well </p>

<blockquote>
  <p>""Are developed and maintained; and""</p>
  
  <p>""Continue to be executed in a timely manner;""</p>
</blockquote>

<p>This is the order it prints it in </p>

<blockquote>
  <p>Implements a process for ensuring that organizational plans for
  conducting security testing, training, and monitoring activities
  associated with organizational information systems:</p>
  
  <p>Reviews testing, training, and monitoring plans for consistency with
  the organizational risk management strategy and organization-wide
  priorities for risk response actions.</p>
  
  <p>Are developed and maintained; and </p>
  
  <p>Continue to be executed in a timely manner;</p>
</blockquote>

<p>what should I change so that it only prints </p>

<blockquote>
  <p>Implements a process for ensuring that organizational plans for
  conducting security testing, training, and monitoring activities
  associated with organizational information systems:</p>
  
  <p>Reviews testing, training, and monitoring plans for consistency with
  the organizational risk management strategy and organization-wide
  priorities for risk response actions.</p>
</blockquote>

<p>Python Code</p>

<pre><code>import xml.etree.ElementTree as ET 
import csv


xmlFile='/Users/username/Desktop/xmlFile.xml'
tree = ET.parse(xmlFile) 
root = tree.getroot()

# open a file for writing
excelFile = open('/Users/username/Desktop/table2.csv', 'w')

# creates the csv writer object / varible to write to csv
csvwriter = csv.writer(excelFile)

# list that contains the header
list_head = []
count = 0

for element in root.findall('control'):
    list_nodes=[]
    if count == 0:

        number = element.find('number').tag
        list_head.append(number)

        description =element.find('.//statement/description').tag
        list_head.append(description)

        csvwriter.writerow(list_head)
        count = count + 1

    # Control number 
    number = 'Nist800-53-V4-' + element.find('number').text  
    list_nodes.append(number)


    # Control Description 
    if element.find('.//statement'):
        if element.find('.//statement/statement/') is not None:
            for descrip in element.findall('.//statement/statement/description'):
                descrip_value = descrip.text
                print(descrip_value)

    csvwriter.writerow(list_nodes)
excelFile.close()

</code></pre>

<p>XML file</p>

<pre><code>&lt;?xml version=""1.0"" encoding=""UTF-8""?&gt;
&lt;controls&gt;
  &lt;control&gt;
    &lt;family&gt;PROGRAM MANAGEMENT&lt;/family&gt;
    &lt;number&gt;PM-14&lt;/number&gt;
    &lt;title&gt;TESTING, TRAINING, AND MONITORING&lt;/title&gt;
    &lt;statement&gt;
      &lt;description&gt;The organization:&lt;/description&gt;
      &lt;statement&gt;
        &lt;number&gt;PM-14a.&lt;/number&gt;
        &lt;description&gt;
        Implements a process for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational information systems:
        &lt;/description&gt;
        &lt;statement&gt;
          &lt;number&gt;PM-14a.1.&lt;/number&gt;
          &lt;description&gt;Are developed and maintained; and&lt;/description&gt;
        &lt;/statement&gt;
        &lt;statement&gt;
          &lt;number&gt;PM-14a.2.&lt;/number&gt;
          &lt;description&gt;Continue to be executed in a timely manner;&lt;/description&gt;
        &lt;/statement&gt;
      &lt;/statement&gt;
      &lt;statement&gt;
        &lt;number&gt;PM-14b.&lt;/number&gt;
        &lt;description&gt;
        Reviews testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
        &lt;/description&gt;
      &lt;/statement&gt;
    &lt;/statement&gt;
    &lt;supplemental-guidance&gt;
      &lt;description&gt;
      This control ensures that organizations provide oversight for the security testing, training, and monitoring activities conducted organization-wide and that those activities are coordinated. With the importance of continuous monitoring programs, the implementation of information security across the three tiers of the risk management hierarchy, and the widespread use of common controls, organizations coordinate and consolidate the testing and monitoring activities that are routinely conducted as part of ongoing organizational assessments supporting a variety of security controls. Security training activities, while typically focused on individual information systems and specific roles, also necessitate coordination across all organizational elements. Testing, training, and monitoring plans and activities are informed by current threat and vulnerability assessments.
      &lt;/description&gt;
      &lt;related&gt;AT-3&lt;/related&gt;
      &lt;related&gt;CA-7&lt;/related&gt;
      &lt;related&gt;CP-4&lt;/related&gt;
      &lt;related&gt;IR-3&lt;/related&gt;
      &lt;related&gt;SI-4&lt;/related&gt;
    &lt;/supplemental-guidance&gt;
    &lt;references&gt;
      &lt;reference&gt;
        &lt;item xml:lang=""en-US"" href=""https://csrc.nist.gov/publications/search?keywords-lg=800-16""&gt;NIST Special Publication 800-16&lt;/item&gt;
      &lt;/reference&gt;
      &lt;reference&gt;
        &lt;item xml:lang=""en-US"" href=""https://csrc.nist.gov/publications/search?keywords-lg=800-37""&gt;NIST Special Publication 800-37&lt;/item&gt;
      &lt;/reference&gt;
      &lt;reference&gt;
        &lt;item xml:lang=""en-US"" href=""https://csrc.nist.gov/publications/search?keywords-lg=800-53A""&gt;NIST Special Publication 800-53A&lt;/item&gt;
      &lt;/reference&gt;
      &lt;reference&gt;
        &lt;item xml:lang=""en-US"" href=""https://csrc.nist.gov/publications/search?keywords-lg=800-137""&gt;NIST Special Publication 800-137&lt;/item&gt;
      &lt;/reference&gt;
    &lt;/references&gt;
  &lt;/control&gt;
&lt;/controls&gt;
</code></pre>
",https://stackoverflow.com/questions/60746070/xml-xpath-and-nesting-in-python,"['python', 'xml', 'xpath', 'elementtree']",59,True,0,1
Is it possible to require app specific PIN authentication for Android Keystore,"<p>I'm trying to implement local PIN authentication securely. As per OWASP MSTG (<a href=""https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication"" rel=""nofollow noreferrer"">https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication</a>), there are 2 ways of doing this.</p>

<ol>
<li>Use Confirm Credentials for use to authenticate using device lockscreen credentials (PIN/password/pattern)</li>
<li>Use Biometric authentication</li>
</ol>

<p>Biometric is fine. However, confirm credentials seems to be tied to the device credentials. Is there any way of unlocking the Android Keystore using application specific credentials instead?</p>
",https://stackoverflow.com/questions/60594439/is-it-possible-to-require-app-specific-pin-authentication-for-android-keystore,"['android', 'authentication']",210,False,2,0
How to stop cookie manipulation for HTML to JSP page redirection?,"<p>I am trying to redirect my user from a html page to a jsp page which has been deployed on tomcat/webapps using .war file. </p>

<p>While doing so, I am also sending the session information of the user as an hidden parameter via POST method.</p>

<p>With the help of <strong>burpsuite</strong> tool(security testing tool) one can easily manipulate the cookie and change the username of the user logged in. How will I be able to block such kind of cookie manipulation? </p>
",https://stackoverflow.com/questions/59560660/how-to-stop-cookie-manipulation-for-html-to-jsp-page-redirection,"['html', 'session-cookies']",76,True,0,1
Best way to sanitize Input data to avoid script execution,"<h3>Background Information</h3>
<p>I'm new to Laravel community and recently I tried building a small App. During a security testing I found any input with Script element to a form actually executes that in real time.</p>
<h3>Example</h3>
<p>Following are the combination of input that I have tried so far.</p>
<ul>
<li>Foo (Works Correctly)</li>
<li>Fooalert(1) (Throws a alert window)</li>
</ul>
<pre><code>&lt;input type=&quot;text&quot; name=&quot;name&quot;&gt;
</code></pre>
<p>This is a security issue and I'm looking on possibilities to fix this. I'm sure any data before entering to database gets sanitized but issue is with HTML display.</p>
",https://stackoverflow.com/questions/65506904/best-way-to-sanitize-input-data-to-avoid-script-execution,"['php', 'laravel']",428,True,0,2
Spring REST Security Testing - Cross Origin Issue,"<p>I am working on Spring Boot and Spring Rest application. The Security Testing have reported the issue </p>

<blockquote>
  <p>""The web application or services inform web client of the allowed domain using the HTTP response header Access-Control-Allow-Origin. The header can contain a '*' to indicate that all domain are allowed.""</p>
</blockquote>

<p>Remediation - </p>

<blockquote>
  <p>Use the Access-Control-Allow-Origin header only on chosen URLs that need to be accessed cross-domain. Don't use the header for the whole domain.</p>
</blockquote>

<p>While making the HTTP request, they've used <code>origin: null</code>, then <code>Access-Control-Allow-Origin: *</code> </p>

<p>How can I implement this?</p>
",https://stackoverflow.com/questions/61210074/spring-rest-security-testing-cross-origin-issue,"['cross-domain', 'spring-rest', 'cross-origin-read-blocking', 'security-testing']",86,True,0,1
Sort XML child nodes by date field in Groovy Script,"<p>My XML is like below... I need to sort <em>EmpJob</em> nodes under <em>jobInfoNav</em> by startDate element. I tried below codes and followed below logs, it doesn't give any error but list is not sorting. Please help.</p>
<h2>I am using this groovy script in SAP CPI.</h2>
<h2>XML</h2>
<pre><code>&lt;PerPerson&gt;
&lt;PerPerson&gt;
  &lt;employmentNav&gt;
    &lt;EmpEmployment&gt;
      &lt;jobInfoNav&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10193&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;SP&lt;/eventReason&gt;
          &lt;startDate&gt;2020-09-20T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10196&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;RP&lt;/eventReason&gt;
          &lt;startDate&gt;2019-04-14T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10186&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;RL&lt;/eventReason&gt;
          &lt;startDate&gt;2019-08-19T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10203&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;HN&lt;/eventReason&gt;
          &lt;startDate&gt;2018-05-02T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10193&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;ZC&lt;/eventReason&gt;
          &lt;startDate&gt;2020-03-08T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10193&lt;/event&gt;
          &lt;userId&gt;abc123&lt;/userId&gt;
          &lt;eventReason&gt;EC&lt;/eventReason&gt;
          &lt;startDate&gt;2018-09-23T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
      &lt;/jobInfoNav&gt;
    &lt;/EmpEmployment&gt;
  &lt;/employmentNav&gt;
&lt;/PerPerson&gt;
&lt;PerPerson&gt;
  &lt;employmentNav&gt;
    &lt;EmpEmployment&gt;
      &lt;jobInfoNav&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10203&lt;/event&gt;
          &lt;userId&gt;abc789&lt;/userId&gt;
          &lt;eventReason&gt;HN&lt;/eventReason&gt;
          &lt;startDate&gt;2020-06-22T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10193&lt;/event&gt;
          &lt;userId&gt;abc789&lt;/userId&gt;
          &lt;eventReason&gt;ZC&lt;/eventReason&gt;
          &lt;startDate&gt;2020-06-22T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10180&lt;/event&gt;
          &lt;userId&gt;abc789&lt;/userId&gt;
          &lt;eventReason&gt;LD&lt;/eventReason&gt;
          &lt;startDate&gt;2020-06-24T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
      &lt;/jobInfoNav&gt;
    &lt;/EmpEmployment&gt;
  &lt;/employmentNav&gt;
&lt;/PerPerson&gt;
&lt;PerPerson&gt;
  &lt;employmentNav&gt;
    &lt;EmpEmployment&gt;
      &lt;jobInfoNav&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10193&lt;/event&gt;
          &lt;userId&gt;abc999&lt;/userId&gt;
          &lt;eventReason&gt;SP&lt;/eventReason&gt;
          &lt;startDate&gt;2020-08-30T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10206&lt;/event&gt;
          &lt;userId&gt;abc999&lt;/userId&gt;
          &lt;eventReason&gt;RN&lt;/eventReason&gt;
          &lt;startDate&gt;2020-08-24T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
        &lt;EmpJob&gt;
          &lt;event&gt;10203&lt;/event&gt;
          &lt;userId&gt;abc999&lt;/userId&gt;
          &lt;eventReason&gt;HC&lt;/eventReason&gt;
          &lt;startDate&gt;2020-01-21T00:00:00.000&lt;/startDate&gt;
        &lt;/EmpJob&gt;
      &lt;/jobInfoNav&gt;
    &lt;/EmpEmployment&gt;
  &lt;/employmentNav&gt;
</code></pre>
<hr />
<h2>groovy script</h2>
<pre><code>   def xml =  new XmlSlurper().parseText(body)     //use of of these depending on which code you are using
   def xml =  new XmlParser().parseText(body)   //use of of these depending on which code you are using

     XmlUtil.serialize(new StreamingMarkupBuilder().bind {                                           
PerPerson{
    PerPerson {
        employmentNav{
            EmpEmployment{
                jobInfoNav{
                     xml.jobInfoNav[0]
                     .children()
                     .sort { Date.parse(&quot;yyyy-MM-dd'T'HH:mm:ss.sss&quot;, it.startDate.text()) }
                     .each { e -&gt;
                         EmpJob {
                                event(e.event.text())
                                userId(e.userId.text())
                                eventReason(e.eventReason.text())
                                startDate(e.startDate.text())
                                }     
                                        
                            }
                        }
   
                     }
                 }
             }
         }
    }
    )
 
    message.setBody(XmlUtil.serialize(xml))
</code></pre>
<p>also tried below</p>
<pre><code>// xml.PerPerson.employmentNav.EmpEmployment.jobInfoNav.EmpJob.sort(true) {it.attribute('startDate')} 
</code></pre>
<p>also tried below code</p>
<pre><code> new StreamingMarkupBuilder().bind {                                                                    // not working
    xml.PerPerson.PerPerson.EmpEmploymentNav.EmpEmployment.jobInfoNav[0].children().sort { Date.parse(&quot;yyyy-MM-dd'T'HH:mm:ss.sss&quot;, it.startDate.text()) }
                     .each { e -&gt;
                         EmpJob {
                                event(e.event.text())
                                userId(e.userId.text())
                                eventReason(e.eventReason.text())
                                startDate(e.startDate.text())
                                }
                            }
                        }
</code></pre>
<p>I don't see any errors but EmpJob nodes not sorted. Please help.</p>
<p>followed online threads</p>
<p><a href=""https://groups.google.com/forum/#!topic/groovy-user/rNapYFuFl-0"" rel=""nofollow noreferrer"">https://groups.google.com/forum/#!topic/groovy-user/rNapYFuFl-0</a></p>
<p><a href=""https://community.smartbear.com/t5/API-Functional-Security-Testing/Sorting-XML-response-before-assertion/td-p/107186"" rel=""nofollow noreferrer"">https://community.smartbear.com/t5/API-Functional-Security-Testing/Sorting-XML-response-before-assertion/td-p/107186</a></p>
<p><a href=""https://stackoverflow.com/questions/33675218/how-to-sort-xml-with-groovy-using-value-of-node-date"">How to sort XML with Groovy using value of Node (Date)</a></p>
<p><a href=""https://stackoverflow.com/questions/18150601/use-groovy-to-sort-xml-file"">Use Groovy to Sort XML File</a></p>
<p><a href=""https://stackoverflow.com/questions/3558780/sorting-xml-in-groovy"">Sorting XML in Groovy</a></p>
",https://stackoverflow.com/questions/64723136/sort-xml-child-nodes-by-date-field-in-groovy-script,"['xml', 'sorting', 'groovy', 'hci']",1282,True,1,1
IIS Server: Restrict users to access files of server,"<p>I have one server, which allows users to host their web app free of cost.</p>

<p>In server I have 4 different pools. </p>

<p>2 pools are for .Net Framework, 
1 pool is for .Net MVC,
1 pool is for .Net Core 3.1</p>

<p>Each pools has 50+ appliations.</p>

<p>For security testing I have created one program, Which takes fullpath/location of file and read that file form IIS server. If any user upload that type of code in my server then they can assess any files.</p>

<p>Now, that is the issue with my server.  </p>

<p>Now, I want to do, My users can access only their application resources not other's too.</p>

<p>But, I don't know how to do this.</p>
",https://stackoverflow.com/questions/62241203/iis-server-restrict-users-to-access-files-of-server,"['security', 'iis', 'web-config', 'hosting']",105,False,0,1
Deploy all dependencies from pom.xml to JFrog Artifactory,"<p>I am a newbie to JFrog.  As part of security testing, I was told to use JFrog to download all the jar instead of maven repository. Is it possible to auto deploy all dependencies from pom.xml to JFrog artifacts instead of uploading each jar to JFrog artifact? So that later I can point my pom repository to this JFrog atifactory where the necessary dependencies are already deployed in JFrog?</p>
<p>Edit:
The bottom line is, no dependencies should be downloaded from internet/maven. It should be downloaded via JFrog so that I can have control over versions being used in projects. For instance,there should be only one spring framework version for all the projects. All the upload of jars should be done manually to the JFrog Repository.</p>
",https://stackoverflow.com/questions/63882250/deploy-all-dependencies-from-pom-xml-to-jfrog-artifactory,"['maven', 'pom.xml', 'artifactory']",1875,True,0,2
Can I have a template for a Gitlab pipeline in my organization?,"<p>In my organization, we are in a transition phase. Big projects get split up into micro services. While this is nice to bring complexity down, the downside is that some parts which should be the same everywhere are more work.</p>
<p>For example, I would like every project to have some tools in the CI pipeline:</p>
<ul>
<li>Software Composition Analysis (SCA)</li>
<li>Static Application Security Testing (SAST)</li>
<li>Unit Tests</li>
</ul>
<p>What the tools are might differ from project to project (essentially by programming language). It might also be that this changes - for example, one might want to add the type checker later. Once the type checker is there, one might enforce some of the values (while keeping others flexible, to be changed by the microservices).</p>
<p>Is it possible to have a shared template for a CI pipeline in GitLab? I'm not looking something people can copy-and-paste. I'm looking for a solution that allows me to adjust the CI pipeline of multiple projects at once, without causing more work for me when more microservices are added (the changes don't have to be applied instantly)</p>
",https://stackoverflow.com/questions/64925659/can-i-have-a-template-for-a-gitlab-pipeline-in-my-organization,"['microservices', 'gitlab-ci']",68,True,0,1
"ZAP: Mix manual browsing, active scanning and fuzzing for testing a very large Web application?","<p>We've got a very large Web application with about 1000 pages to be tested (<a href=""http://www.project-open.com/"" rel=""nofollow noreferrer"">www.project-open.com</a>, a project + finance management application for service companies). Each page may take multiple parameters (object-id, filters, column name to use for sorting, ...). We are now going to implement additional security checks on these parameters, so we need to systematically test that a) offensive parameter values are rejected and b) that the parameter values actually used by the application are accepted correctly. </p>

<p>Example: We might want to say that the sort_column parameter in a page should only consist of alphanumeric characters. But the application in reality may include a column name with a space in it, leading to a false positive security alert (space character not being an alphanumeric character).</p>

<p>My idea for testing this would be to 1) manually navigate to each of these pages in proxy mode, 2) tell ZAP to start spidering all links on this page for one or two levels and 3) tell ZAP to start fuzzing on these URLs.</p>

<p>How can this be implemented? I've got a basic understanding of ZAP and did some security testing of ]project-open[. I've read about a ZAP extension for scanning a list of URLs, but in our case we want to execute some specific ZAP actions on each of these URLs...</p>
",https://stackoverflow.com/questions/62262592/zap-mix-manual-browsing-active-scanning-and-fuzzing-for-testing-a-very-large-w,"['testing', 'web-applications', 'zap', 'security-testing']",141,True,0,1
Prevent Open URL Redirect from gorilla/mux,"<p>I am working on a RESTful web application using Go + gorilla/mux v1.4 framework. Some basic security testing after a release revealed an <a href=""https://portswigger.net/kb/issues/00500100_open-redirection-reflected"" rel=""nofollow noreferrer"">Open URL Redirection</a> vulnerability in the app that allows user to submit a specially crafted request with an external URL that causes server to response with a 301 redirect. </p>

<p>I tested this using <a href=""https://portswigger.net/burp"" rel=""nofollow noreferrer"">Burp Suite</a> and found that any request that redirects to an external URL in the app seems to be responding with a 301 Moved Permanently. I've been looking at all possible ways to intercept these requests before the 301 is sent but this behavior seems to <a href=""https://github.com/golang/go/blob/master/src/net/http/server.go#L2344"" rel=""nofollow noreferrer"">be baked into the net/http server implementation</a>.</p>

<p>Here is the raw request sent to the server (myapp.mycompany.com:8000): </p>

<pre><code>GET http://evilwebsite.com HTTP/1.1
Accept: */*
Cache-Control: no-cache
Host: myapp.mycompany.com:8000
Content-Length: 0
</code></pre>

<p>And the response any time is:</p>

<pre><code>HTTP/1.1 301 Moved Permanently
Location: http://evilwebsite.com/
Date: Fri, 13 Mar 2020 08:55:24 GMT
Content-Length: 0
</code></pre>

<p>Despite putting in checks for the request.URL to prevent this type of redirect in the http.handler, I haven't had any luck getting the request to reach the handler. It appears that the base http webserver is performing the redirect without allowing it to reach my custom handler code as defined in the PathPrefix(""/"").Handler code.</p>

<p>My goal is to ensure the application returns a 404-Not Found or 400-Bad Request for such requests. Has anybody else faced this scenario with gorilla/mux. I tried the same with a Jetty web app and found it returned a perfectly valid 404. I've been at this for a couple of days now and could really use some ideas.</p>
",https://stackoverflow.com/questions/60668000/prevent-open-url-redirect-from-gorilla-mux,"['go', 'redirect', 'gorilla', 'go-http']",599,True,0,1
Request not reaching server (Host header injection),"<p>I have a project in which the client's requirement is to guard against the host header injection attack. I handled the problem at the application level, creating a middleware that checks for the incoming ""Host"" header and then aborts (403) if it's not among the trusted ones. The problem is how to test this code, as I don't know about security testing much. I learned that there's the Burp Suite proxy tool to intercept any request and edit the headers so I did that. However, I'm getting a very strange behavior: when I edit the host header, the request doesn't even hit my server.</p>

<p>Allow me to explain the scenario. I'm on the password reset page, i.e., GET <code>/lender/password/reset</code>. On this page we have to enter the email address and hit the reset button, which sends a POST to <code>/lender/password/email</code> and redirects back to GET <code>/lender/password/reset</code> (Laravel devs will recognize this standard, baked-in flow).</p>

<p><a href=""https://i.stack.imgur.com/7S6yW.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/7S6yW.png"" alt=""enter image description here""></a></p>

<p>So, when I use Burp tools and don't tamper with the headers, the app works as expected, but when I change the ""Host"" (say, to google.com), then the above-mentioned POST request gets converted to a GET request and since the host is now new, it doesn't even reach the application.</p>

<p>Please see this screenshot from the Burp tools history below (the free edition doesn't allow an export but I'll type it out if needed). Looks at lines 468 and 469: the POST to <code>/lender/password/email</code> is getting converted to a GET, and then naturally there's a 404 on google.com. It's also strange that there's a 301 redirect on line 468 (showing the app's hostname) which isn't part of the normal flow.</p>

<p><a href=""https://i.stack.imgur.com/YHHOg.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/YHHOg.png"" alt=""enter image description here""></a></p>

<p>My problem is that the client is using this to claim that our application isn't safe against this attack, whereas to me it looks like the tampered requests aren't even reaching our server and there's this weird 301. The ideal outcome would be to send the user back when a wrong ""Host"" value is received.</p>

<p>And finally, what would be the right way to conduct this attack?</p>
",https://stackoverflow.com/questions/62112833/request-not-reaching-server-host-header-injection,"['laravel', 'http-headers', 'burp']",851,False,0,0
What happens to the encrypted app specific data when enrolled (one) fingerprint is deleted from device?,"<p>Full Question : What happens to the encrypted app-specific data when enrolled (one) fingerprint is deleted from device and the associated cryptographic key (app-specific) stored in TEE gets permanently invalidated?</p>

<p>I am not an Android developer, so I do not have much coding knowledge. I was going through the working of Android Cryptography, especially the Local Authentication mechanism and have understood it this way: </p>

<p>In short: Following information from <a href=""https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05f-Testing-Local-Authentication.md#local-authentication-on-android"" rel=""nofollow noreferrer"">OWASP Mobile Security Testing Guide:</a> </p>

<ol>
<li>An app can use user's fingerprint to unlock itself (after a set period of inactivity).  </li>
<li>This authentication mechanism should be supported by Cryptography to prove itself strong/secure. </li>
<li>We need to create a crypto Key which should be set with a property - setUserAuthenticationRequired(true), for it to be used only after fingerprint or device PIN verification.

<ol start=""4"">
<li>This key could be used to sign/encrypt-decrypt the app-specific data, thereby making the whole process implement a cryptographic primitive.</li>
</ol></li>
</ol>

<p>The trouble in my head is with the following from <a href=""https://developer.android.com/reference/android/security/keystore/KeyPermanentlyInvalidatedException"" rel=""nofollow noreferrer"">Android documentation:</a></p>

<p><em>This only occurs for keys which are authorized to be used only if the user has been authenticated. Such keys are permanently and irreversibly invalidated once the secure lock screen is disabled (i.e., reconfigured to None, Swipe or other mode which does not authenticate the user) or when the secure lock screen is forcibly reset (e.g., by Device Admin). Additionally, keys configured to require user authentication to take place for every of the keys, are also permanently invalidated once a new fingerprint is enrolled or once no more fingerprints are enrolled.</em></p>

<p>The question is, if my device has a fingerprint enrolled and my app has set fingerprint authentication, in that case, a key would then be created and used to perform the crypto operations (say encrypt-decrypt). This encrypted data would then be stored in the app's local storage. In a case, where-in the user deletes his fingerprint from the device, as per the Android documentation, the key would get invalidated. In such a case, how would my app's encrypted data get decrypted for further usuage?? Because you need the same key to decrypt the data, which is now irreversibly invalided. </p>

<p>I am aware of the fallback mechanism, wherein if the fingerprint is not found, Android falls back to the PIN or Pattern device authentication. But this would again not create a new key, isn’t it? Or provide access to the same old key used by fingerprint auth (as it is invalidated). </p>

<p>So, what happens to the App's data? Does it get deleted?  Does user has to start afresh, setting up the account and preferences? </p>
",https://stackoverflow.com/questions/60162660/what-happens-to-the-encrypted-app-specific-data-when-enrolled-one-fingerprint,"['android', 'fingerprint', 'android-security', 'android-fingerprint-api', 'android-biometric-prompt']",146,False,1,0
