title,body,link,tags,view_count,is_answered,score,answer_count
Quarkus OpenId Connect Bearer Token Integration/Security Testing,"<p>I'm following <a href=""https://quarkus.io/guides/security-openid-connect#integration-testing-wiremock"" rel=""nofollow noreferrer"">https://quarkus.io/guides/security-openid-connect#integration-testing-wiremock</a> to create some tests for my Quarkus app:</p>
<pre><code>@QuarkusTest
@TestHTTPEndpoint(BannerApi.class)
@QuarkusTestResource(OidcWiremockTestResource.class)
public class BannerApiTest {
    @Test
    public void testListUnauthenticated() {
        when().get().then().statusCode(401);
    }
}
</code></pre>
<p>I followed the setup as-is, except I created <code>application.properties</code> in <code>src/test/resources</code> with the following contents:</p>
<pre><code>quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus/
quarkus.oidc.client-id=quarkus-service-app
quarkus.oidc.application-type=service
smallrye.jwt.sign.key.location=privateKey.jwk
</code></pre>
<p>But here's what I get:</p>
<pre><code>2021-08-03 21:18:41,731 INFO  [org.ecl.jet.uti.log] (pool-5-thread-1) Logging initialized @14312ms to org.eclipse.jetty.util.log.Slf4jLog
...
2021-08-03 21:18:42,041 INFO  [io.qua.tes.oid.ser.OidcWiremockTestResource] (pool-5-thread-1) Keycloak started in mock mode: http://localhost:64289
...
2021-08-03 21:18:44,348 INFO  [org.ecl.jet.ser.han.ContextHandler] (main) Stopped o.e.j.s.ServletContextHandler@520fdce4{/__admin,null,STOPPED}
2021-08-03 21:18:44,349 INFO  [io.qua.tes.oid.ser.OidcWiremockTestResource] (main) Keycloak was shut down

java.lang.RuntimeException: java.lang.RuntimeException: Failed to start quarkus

    at io.quarkus.test.junit.QuarkusTestExtension.throwBootFailureException(QuarkusTestExtension.java:686)
    at io.quarkus.test.junit.QuarkusTestExtension.interceptTestClassConstructor(QuarkusTestExtension.java:759)
    at org.junit.jupiter.engine.execution.ExecutableInvoker.lambda$invoke$0(ExecutableInvoker.java:105)
    at org.junit.jupiter.engine.execution.InvocationInterceptorChain$InterceptedInvocation.proceed(InvocationInterceptorChain.java:106)
...
Caused by: java.lang.RuntimeException: Failed to start quarkus
    at io.quarkus.runner.ApplicationImpl.doStart(ApplicationImpl.zig:1114)
    at io.quarkus.runtime.Application.start(Application.java:101)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    ... 31 more
Caused by: javax.enterprise.inject.spi.DeploymentException: Configuration validation failed:
    keycloak.url does not map to any root
    at io.quarkus.arc.runtime.ConfigRecorder.registerConfigMappings(ConfigRecorder.java:67)
    at io.quarkus.deployment.steps.ConfigBuildStep$registerConfigClasses-2116437784.deploy_0(ConfigBuildStep$registerConfigClasses-2116437784.zig:292)
    at io.quarkus.deployment.steps.ConfigBuildStep$registerConfigClasses-2116437784.deploy(ConfigBuildStep$registerConfigClasses-2116437784.zig:40)
    ... 46 more
Caused by: io.smallrye.config.ConfigValidationException: Configuration validation failed:
    keycloak.url does not map to any root
    at io.smallrye.config.ConfigMappingProvider.mapConfiguration(ConfigMappingProvider.java:829)
    at io.smallrye.config.ConfigMappingProvider.mapConfiguration(ConfigMappingProvider.java:785)
    at io.smallrye.config.ConfigMappings.mapConfiguration(ConfigMappings.java:54)
    ... 49 more


org.opentest4j.TestAbortedException: Boot failed


    at io.quarkus.test.junit.QuarkusTestExtension.throwBootFailureException(QuarkusTestExtension.java:688)
    at io.quarkus.test.junit.QuarkusTestExtension.interceptTestClassConstructor(QuarkusTestExtension.java:759)
    at org.junit.jupiter.engine.execution.ExecutableInvoker.lambda$invoke$0(ExecutableInvoker.java:105)
    at org.junit.jupiter.engine.execution.InvocationInterceptorChain$InterceptedInvocation.proceed(InvocationInterceptorChain.java:106)
...
</code></pre>
<p>As you can see from the log, <code>Keycloak started in mock mode: http://localhost:64289 ...</code> but then <code>keycloak.url does not map to any root</code>.</p>
<p>Where do I miss? I'm using Quarkus 2.1.0.</p>
",https://stackoverflow.com/questions/68637903/quarkus-openid-connect-bearer-token-integration-security-testing,['quarkus'],580,False,0,0
"Api automation,Load testing and Security testing Do one project","<p>I want to do API automation and load testing and security testing at the same time using one project. What kind of tool or technology can I use to implement that project?</p>
",https://stackoverflow.com/questions/68367669/api-automation-load-testing-and-security-testing-do-one-project,"['performance', 'api', 'automation', 'load-testing', 'security-testing']",61,False,0,1
Feature and price comparison of continuous inspection / static application security testing platforms,"<p>Is there any representative comparison among major <em>continuous inspection</em> and <em>static application security testing</em> (SAST) platforms like SonarQube, Coverity, CodeScene, TeamScale, etc?</p>
",https://stackoverflow.com/questions/69752102/feature-and-price-comparison-of-continuous-inspection-static-application-secur,"['sonarqube', 'coverity', 'sast']",140,True,0,1
Does sonarqube community edition provide any sort of static application security testing,"<p>We use sonarqube community edition and though it workes great for static code analysis, i don't see anything much significant when it comes to security analysis. It does flag security vulnerabilities and provides security reports for OWASP Top 10 and SANS Top 25. I am wondering if that is part of some static application security testing or we need to go with developer/enterprise editions for fully fledged end to end SAST.
Please clarify.</p>
",https://stackoverflow.com/questions/66124091/does-sonarqube-community-edition-provide-any-sort-of-static-application-security,"['sonarqube', 'static-analysis', 'sonarqube-scan', 'security-testing']",828,False,0,1
Error &quot;sast job: chosen stage does not exist; available stages are&quot; for gitlab Static Application Security Testing,"<p>I tried following <a href=""https://about.gitlab.com/blog/2020/12/16/mobile-static-application-security-testing-for-android/"" rel=""nofollow noreferrer"">these fairly simple instructions for integrating Static Application Security Testing (SAST)</a> into my Android CI/CD pipeline on Gitlab.  However, I got the following error when using the <a href=""https://docs.gitlab.com/ee/ci/lint.html"" rel=""nofollow noreferrer"">CI lint tool</a>:</p>
<pre><code>sast job: chosen stage does not exist; available stages are .pre, stg_build, stg_test, .post
</code></pre>
<p>Here is the simplest version of my .gitlab-ci.yml that reproduces the error:</p>
<pre class=""lang-yaml prettyprint-override""><code>include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXPERIMENTAL_FEATURES: &quot;true&quot;

stages:
  - stg_build
  - stg_test
</code></pre>
<p>I found a similar error in <a href=""https://stackoverflow.com/questions/67840199/gitlab-chosen-stage-does-not-exist"">GitLab: chosen stage does not exist</a> but that was about trying to use an environment variable as a stage name.</p>
<p>How do I prevent this error and get SAST working for my merge requests on Gitlab?</p>
",https://stackoverflow.com/questions/68764789/error-sast-job-chosen-stage-does-not-exist-available-stages-are-for-gitlab-s,"['gitlab', 'gitlab-ci']",5576,True,2,1
ZAP security testing in Mobile - unable to launch app or browser via connected wifi after changing Proxy to manual in mobile ( both android and IOS ),"<p>First I did the below mentioned steps:</p>
<p>&quot;
First you need to install the certificate in your mobile device for ZAP to record it. You can do that by following steps:</p>
<p>Open ZAP
Go to Tools
Click in Options then click in Dynamic SSL Certificate and generate the new and save it.
Then you need to send that certificate to your device, make sure you name the file as &quot;zap&quot;
In the local proxy, set the address &quot;empty&quot;
Then, you need to configure your android/ios application network configuration You can do that by following steps:</p>
<p>Go to advance setting of the network
Click in proxy and set it as &quot;manual&quot;
Then, you need to enter the proxy server to your computer IP address and port to proxy set in the ZAP.&quot;</p>
<p>After these I tried to open browser and app. I am unable to open it. I am getting weak security warning and &quot;Privacy Warning&quot; in my mobile.</p>
<p>Please help me to solve this issue.</p>
",https://stackoverflow.com/questions/70402596/zap-security-testing-in-mobile-unable-to-launch-app-or-browser-via-connected-w,"['security', 'owasp', 'zap', 'security-testing']",410,False,0,1
Feature and price comparison of continuous inspection / static application security testing platforms,"<p>Is there any representative comparison among major <em>continuous inspection</em> and <em>static application security testing</em> (SAST) platforms like SonarQube, Coverity, CodeScene, TeamScale, etc?</p>
",https://stackoverflow.com/questions/69752102/feature-and-price-comparison-of-continuous-inspection-static-application-secur,"['sonarqube', 'coverity', 'sast']",140,True,0,1
Azure Devops - Classic Pipeline - OWASP Zap Scanner Test - Powershell Task,"<p>Trying to Convert ZAP XML to NUnit XML in Azure Devops Release pipeline for OWASP ZAP Security testing, getting following error in Powershell Task. Please help</p>
<pre><code>2021-09-06T09:39:32.4736044Z ##[section]Starting: Convert ZAP XML to NUnit XML
2021-09-06T09:39:32.4744197Z ==============================================================================
2021-09-06T09:39:32.4744531Z Task         : PowerShell
2021-09-06T09:39:32.4744804Z Description  : Run a PowerShell script on Linux, macOS, or Windows
2021-09-06T09:39:32.4745074Z Version      : 2.190.0
2021-09-06T09:39:32.4745298Z Author       : Microsoft Corporation
2021-09-06T09:39:32.4745622Z Help         : https://learn.microsoft.com/azure/devops/pipelines/tasks/utility/powershell
2021-09-06T09:39:32.4746679Z ==============================================================================
2021-09-06T09:39:32.6192068Z Generating script.
2021-09-06T09:39:32.6225079Z ========================== Starting Command Output ===========================
2021-09-06T09:39:32.6236523Z [command]/usr/bin/pwsh -NoLogo -NoProfile -NonInteractive -Command . '/home/vsts/work/_temp/55afabcf-833e-4c93-8d60-c067a14be9ab.ps1'
2021-09-06T09:39:33.5525712Z [91mTransformOWASPReport: [0m/home/vsts/work/r1/a/_Testing/Transform.ps1:28
2021-09-06T09:39:33.5527142Z [96mLine |
2021-09-06T09:39:33.5529111Z [96m  28 | [0m … ransformOWASPReport -XLSTPath $XLSTPath -OWASPFile [96m$OWASPFile[0m -Transf …
2021-09-06T09:39:33.5530107Z [96m     | [91m                                                      ~~~~~~~~~~
2021-09-06T09:39:33.5531096Z [91m[96m     | [91mCannot bind argument to parameter 'OWASPFile' because it is an
2021-09-06T09:39:33.5531923Z [96m     | [91mempty string.
2021-09-06T09:39:33.5781242Z ##[error]PowerShell exited with code '1'.
2021-09-06T09:39:33.5816175Z ##[section]Finishing: Convert ZAP XML to NUnit XML
</code></pre>
",https://stackoverflow.com/questions/69072772/azure-devops-classic-pipeline-owasp-zap-scanner-test-powershell-task,"['xml', 'powershell', 'azure-devops', 'azure-pipelines-release-pipeline', 'devsecops']",587,False,1,1
Can we use owasp zap for mobile application,"<p>I'm trying to build a react native application,(mobile app). Can I use owasp zap for security testing. Or owasp zap only for website and web application.</p>
",https://stackoverflow.com/questions/70154455/can-we-use-owasp-zap-for-mobile-application,"['security', 'owasp', 'zap']",421,False,0,1
"Api automation,Load testing and Security testing Do one project","<p>I want to do API automation and load testing and security testing at the same time using one project. What kind of tool or technology can I use to implement that project?</p>
",https://stackoverflow.com/questions/68367669/api-automation-load-testing-and-security-testing-do-one-project,"['performance', 'api', 'automation', 'load-testing', 'security-testing']",61,False,0,1
Application security scanner,"<p>I am working on a project to develop a SAST(static application security testing) scanner. Can people suggest best practices to read the code base quicker?</p>
<p>I got few ideas like using AST or BCEL.</p>
<p>Please suggest</p>
",https://stackoverflow.com/questions/67487268/application-security-scanner,"['security', 'findbugs', 'brakeman', 'sast']",37,False,0,0
CEFsharp security,"<p>We plan to use the CefSharp in our project. Is there any security threat analysis available on the latest version of Cefsharp.Winforms ?IF so please let me know ,is there any security testing documents available ?  What are the vulnerabilities ?</p>
",https://stackoverflow.com/questions/68921496/cefsharp-security,"['cefsharp', 'chromium-embedded']",177,False,0,0
How can I send request using arbitrary method defined by the user in the Python requests,"<p>I need sending request to arbitrary method without standard method like &quot;GET&quot;, &quot;POST&quot;, &quot;TRACE&quot; ..</p>
<p>How can I do this?</p>
<p>Is it possible to implement additional methods by inheriting a class within the module?</p>
<p>This is to cause an error page for security testing.</p>
",https://stackoverflow.com/questions/65807179/how-can-i-send-request-using-arbitrary-method-defined-by-the-user-in-the-python,['python-requests'],77,False,1,1
Can SonarQube be used for SAST for a dot net core version 3.2 application?,"<p>For a dot net core 3.2 application, can we use SonarQube for Static Application Security Testing (SAST)? If not, then what could be the alternatives.
I am from the Java background and I am aware that plugins like FindSecBugs can be used with SonarQube for Java source code.</p>
<p>Thanks.</p>
",https://stackoverflow.com/questions/69642574/can-sonarqube-be-used-for-sast-for-a-dot-net-core-version-3-2-application,"['jenkins', '.net-core', 'sonarqube', 'sast']",281,True,0,1
i am getting warning Cross-site Scripting (XSS) with innerHTML,"<p>I have a code where I need to send HTML with inner Html but my code is not passing the security testing it showing  Cross-site Scripting (XSS) warning.</p>
<p>how to use innerHtml with out Cross-site Scripting (XSS) issue.</p>
<pre><code> if (e.currentTarget) {
            const { reamoreid } = e.target.dataset;
            axios.get(`/single-readmore/${reamoreid}`).then((response) =&gt; {
                readMoreContent.innerHTML = DOMPurify.sanitize(readmoreInfo(response.data));
            });
</code></pre>
<p>I need some information about how to fix the issue.</p>
",https://stackoverflow.com/questions/69772330/i-am-getting-warning-cross-site-scripting-xss-with-innerhtml,"['javascript', 'jquery', 'node.js', 'xss', 'angular-dom-sanitizer']",314,False,0,1
X-Frame-Options Header Not Set: How do I set it?,"<p>I am using Apache server for Wamp application. While doing security testing, I got these error reports which says:</p>
<ol>
<li><p><strong>X-Frame-Options Header Not Set.</strong>
For this I know that there are 3 types of X-Frame Options. But where do I implement the SAMEORIGIN option and how?</p>
</li>
<li><p><strong>X-Content-Type-Options Header Missing.</strong></p>
</li>
</ol>
<p>What do I need to do to solve these?
Thank you.</p>
",https://stackoverflow.com/questions/66003519/x-frame-options-header-not-set-how-do-i-set-it,"['php', 'apache', 'security', 'x-frame-options', 'x-content-type-options']",2631,True,2,2
Security Vulnerability XSS Dom based,"<p>We are using the ZAP tool for our application security testing and running across a High priority vulnerability in form of Cross site XSS DOM based. Attached image for reference.</p>
<p>Can someone help to set a direction to resolve this. What could be the possible areas we can look into</p>
<p>Additional information : We are using the following libraries in our application JQuery 3.6.0, Bootstrap 4.3.1 <a href=""https://i.stack.imgur.com/Q3OLq.jpg"" rel=""nofollow noreferrer"">Screen Shot ZAP report</a></p>
",https://stackoverflow.com/questions/69193060/security-vulnerability-xss-dom-based,"['security', 'dom', 'xss', 'zap']",628,False,-1,1
Does sonarqube community edition provide any sort of static application security testing,"<p>We use sonarqube community edition and though it workes great for static code analysis, i don't see anything much significant when it comes to security analysis. It does flag security vulnerabilities and provides security reports for OWASP Top 10 and SANS Top 25. I am wondering if that is part of some static application security testing or we need to go with developer/enterprise editions for fully fledged end to end SAST.
Please clarify.</p>
",https://stackoverflow.com/questions/66124091/does-sonarqube-community-edition-provide-any-sort-of-static-application-security,"['sonarqube', 'static-analysis', 'sonarqube-scan', 'security-testing']",828,False,0,1
How to do certificate chain validation on Android and iOS?,"<p>Our app's security testing got a security issue related to certificate chain validation. It's CWE-296 <a href=""https://cwe.mitre.org/data/definitions/296.html"" rel=""nofollow noreferrer"">https://cwe.mitre.org/data/definitions/296.html</a></p>
<p>To my knowledge, adding a certificate pinning solves this problem but I'm not sure if there is a way to do certificate chain validation without pinning.</p>
<p>OWASP-MASVS also mentions about CWE-296 <a href=""https://github.com/OWASP/owasp-masvs/blob/66c2ff24957e994f2f48b08b831b2e69d782ad93/Document/0x10-V5-Network_communication_requirements.md"" rel=""nofollow noreferrer"">here under references</a></p>
<p>Can someone please provide more knowledge on this? Possibly share some example app which does this.</p>
<p>We're using <code>Okhttp</code> for networking!</p>
",https://stackoverflow.com/questions/68579170/how-to-do-certificate-chain-validation-on-android-and-ios,"['android', 'security', 'ssl-certificate', 'okhttp', 'owasp']",627,True,1,1
How to fix OS command-line injection from C# process.start?,"<p>I am writing a console application , which accepts a command line argument and runs a bat file.
I use process.start() for running a bat file. Example  code snippet below</p>
<pre><code> static void Main(string[] args)
        {
            string Folder = @&quot;C:\Program Files\Somefolder&quot;;
            string filename = &quot;someBatFile.bat&quot;;
            Process proc = null;
            try
            {
                string complexityRules = @&quot;^(?=.*[0-9])(?=.*[A-Za-z])(?=.*[!@#$%&amp;*-+=^]).{12,}$&quot;;
               
                if (Regex.IsMatch(args[0], complexityRules))
                {
                    string batDir = string.Format(Folder);
                    proc = new Process();
                    proc.StartInfo.WorkingDirectory = batDir;
                    proc.StartInfo.FileName = filename;
                    if (args[0] != null)
                    {
                        proc.StartInfo.Arguments = args[0];
                    }
                    proc.StartInfo.CreateNoWindow = false;
                    proc.StartInfo.UseShellExecute = false;
                    proc.Start();
                    proc.WaitForExit();
                }


            }
            catch (Exception ex)
            {
                //will be catching exceptions if any 

            }
        }
</code></pre>
<p>I have read some links in web , so used regex for validating an argument before sending it has parameter for process.start() to avoid attack. Even then I get OS command line injection attack(From third party security testing scanner). Am I missing something? Any help appreciated. Thanks in Advance:)</p>
",https://stackoverflow.com/questions/68104795/how-to-fix-os-command-line-injection-from-c-process-start,"['c#', 'code-injection', 'process.start']",792,False,0,0
Error &quot;sast job: chosen stage does not exist; available stages are&quot; for gitlab Static Application Security Testing,"<p>I tried following <a href=""https://about.gitlab.com/blog/2020/12/16/mobile-static-application-security-testing-for-android/"" rel=""nofollow noreferrer"">these fairly simple instructions for integrating Static Application Security Testing (SAST)</a> into my Android CI/CD pipeline on Gitlab.  However, I got the following error when using the <a href=""https://docs.gitlab.com/ee/ci/lint.html"" rel=""nofollow noreferrer"">CI lint tool</a>:</p>
<pre><code>sast job: chosen stage does not exist; available stages are .pre, stg_build, stg_test, .post
</code></pre>
<p>Here is the simplest version of my .gitlab-ci.yml that reproduces the error:</p>
<pre class=""lang-yaml prettyprint-override""><code>include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXPERIMENTAL_FEATURES: &quot;true&quot;

stages:
  - stg_build
  - stg_test
</code></pre>
<p>I found a similar error in <a href=""https://stackoverflow.com/questions/67840199/gitlab-chosen-stage-does-not-exist"">GitLab: chosen stage does not exist</a> but that was about trying to use an environment variable as a stage name.</p>
<p>How do I prevent this error and get SAST working for my merge requests on Gitlab?</p>
",https://stackoverflow.com/questions/68764789/error-sast-job-chosen-stage-does-not-exist-available-stages-are-for-gitlab-s,"['gitlab', 'gitlab-ci']",5576,True,2,1
Consume Attribute Ignored when Authorize Policy is applied to entire controller,"<p>We have been doing some security testing and have found an issue where if an incorrect Content-Type is posted then a 400 is returned instead of 415.</p>
<p>Now this only happens if I apply my Authorize attribute to the entire controller, and then set my Consumes Attribute on the post action. When the Authorize Attribute is applied to only an action along with the Consumes Attribute then this works just fine.</p>
<p>This works: Returns 415</p>
<pre><code>public class MyController : Controller
{
        [HttpPost]
        [Authorize(Policy = &quot;MyPolicy&quot;)]
        [Consumes(&quot;application/x-www-form-urlencoded&quot;)]
        public async Task&lt;IActionResult&gt; APostActrion(MyModel model)
        {
            return View();
        }

}
</code></pre>
<p>This Doesn't: Returns 400</p>
<pre><code>[Authorize(Policy = &quot;MyPolicy&quot;)]
public class MyController : Controller
    {
            [HttpPost]                
            [Consumes(&quot;application/x-www-form-urlencoded&quot;)]
            public async Task&lt;IActionResult&gt; APostActrion(MyModel model)
            {
                return View();
            }
    
    }
</code></pre>
<p><strong>EDIT</strong></p>
<p>Here is an example of my policy</p>
<pre><code>options.AddPolicy(&quot;MyPolicy&quot;, b =&gt;
            {
                b.RequireAuthenticatedUser();
                b.RequireClaim(ClaimTypes.Role, &quot;MyRole&quot;);
                b.Requirements.Add(new OrganisationRequirement());
            });
</code></pre>
<p>Here is the AuthorizationHandler for OrganisationRequirement</p>
<pre><code>public class OrganisationHandler : AuthorizationHandler&lt;OrganisationRequirement&gt;
    {
        private readonly StatelessServiceContext _context;

        public OrganisationHandler(StatelessServiceContext context)
        {
            _context = context;
        }

        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, OrganisationRequirement requirement)
        {
            if (CanRequest(context))
            {
                context.Succeed(requirement);
            }
            else
            {
                context.Fail();
            }

            return Task.CompletedTask;
        }

        private bool CanRequest(AuthorizationHandlerContext context)
        {
            string OrgId = Encoding.Unicode.GetString(_context.InitializationData, 0, _context.InitializationData.Length);
            if (string.IsNullOrEmpty(OrgId))
            {
                return true;
            }

            if (context.User.HasClaim(c =&gt; c.Type == ClaimTypes.Role &amp;&amp; (c.Value == RoleNames.SysAdmin)))
            {
                return true;
            }

            if (context.User.HasClaim(c =&gt; c.Type == ClaimTypes.Role &amp;&amp; c.Value == RoleNames.Service)
                &amp;&amp; context.User.HasClaim(c =&gt; (c.Type == CustomClaimTypes.OrgCode) &amp;&amp; (c.Value == &quot;system&quot;)))
            {
                return true;
            }

            if (context.User.HasClaim(c =&gt; (c.Type == CustomClaimTypes.OrgCode) &amp;&amp; c.Value == OrgId))
            {
                return true;
            }

            return false;
        }
    }
</code></pre>
",https://stackoverflow.com/questions/67433556/consume-attribute-ignored-when-authorize-policy-is-applied-to-entire-controller,"['asp.net-core-mvc', 'asp.net-core-3.1']",145,True,0,1
X-Frame-Options Header Not Set: How do I set it please?,"<p>I am using Apache server. While doing security testing, I got these error reports which says:</p>
<p>X-Frame-Options Header Not Set. For this I know that there are 3 types of X-Frame Options. But where do I implement the SAMEORIGIN option and how?</p>
<p>Header set X-Frame-Options: &quot;SAMEORIGIN&quot;</p>
<p>Tried adding the above in apache2.conf in /etc/apache2/
Tried with .htaccess file also</p>
<p>Restarted Apache and tried in Chrome , Developer Tools -&gt; Networks -&gt; Headers</p>
<p>No effect of new header . Please clarify how to add this header with file details.</p>
",https://stackoverflow.com/questions/68640273/x-frame-options-header-not-set-how-do-i-set-it-please,"['x-frame-options', 'clickjacking']",565,False,0,1
Using OWASP ZAP Proxy for existing suite of Selenium tests,"<p>We have a suite of automated regression tests driven using Selenium for an Angular app with a .NET Core WEB API backend.</p>
<p>The intention is to include some automated security testing as part of our overnight build/test run.</p>
<p>From reading so far it looks like running ZAP as an intercepting proxy between Selenium and our web application is the way to go (see 'Proxy Regression/Unit Tests' in <a href=""https://www.zaproxy.org/docs/api/#exploring-the-app"" rel=""nofollow noreferrer"">https://www.zaproxy.org/docs/api/#exploring-the-app</a>) but I'm struggling to find clear documentation/examples.</p>
<p>What is the simplest way to achieve this using OWASP ZAP, and are there any definitive articles/examples available?</p>
",https://stackoverflow.com/questions/67687498/using-owasp-zap-proxy-for-existing-suite-of-selenium-tests,"['selenium', 'owasp', 'zap']",505,True,0,1
How to hack this URL with BurpSuite?,"<p>The website shows a list of active users, nothing else. Goal is to edit the header to include some bash command injection to crack the site, and this will give a URL for the next site to try and break for a security testing course.</p>
<p>The URL has two GET requests one when the page is loading (1) and one when the website is 'checking for users' (2)</p>
<p>This is the GET request (2):</p>
<pre><code>GET /ekohshahrabohpha/cgi-bin/users.php HTTP/1.1
Host: 134.219.148.11:61166
Connection: close
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4
Accept-Language: en-us
Referer: http://134.219.148.11:61166/ekohshahrabohpha/
Accept-Encoding: gzip, deflate
</code></pre>
<p>This is the Header (1):</p>
<pre><code>GET /ekohshahrabohpha/ HTTP/1.1
Host 134.219.148.11:61166
Accept-Encoding gzip, deflate
User-Agent Mozilla/5.0(Macintosh; Intel Mac OS X ... )
Accept-Language en-us
Cache-Control max-age=0
Connection close
</code></pre>
<p>The source code for the page:</p>
<pre><code>&lt;!DOCTYPE html&gt;
&lt;html lang=&quot;en&quot;&gt;
  &lt;head&gt;
    &lt;meta charset=&quot;utf-8&quot;&gt;
    &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
    &lt;title&gt;Level 2&lt;/title&gt;
    &lt;link href=&quot;http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css&quot; rel=&quot;stylesheet&quot;&gt;
    &lt;link href=&quot;http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap-theme.min.css&quot; rel=&quot;stylesheet&quot;&gt;
    &lt;link href=&quot;site.css&quot; rel=&quot;stylesheet&quot;&gt;
  &lt;/head&gt;

&lt;body&gt;
  &lt;div class=&quot;container&quot;&gt;
    &lt;div class=&quot;page-header&quot;&gt;
      &lt;h1&gt;Level 2&lt;/h1&gt;
      &lt;p class=&quot;lead&quot;&gt;
        &lt;h2&gt;Active Users&lt;/h2&gt;
      &lt;/p&gt;
    &lt;/div&gt;


    &lt;div id=&quot;userlist&quot;&gt;
      &lt;pre&gt;Checking for users...&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/div&gt;
&lt;script language=&quot;JavaScript&quot;&gt;
var http_request = false;

  function getusers() {
    if (window.XMLHttpRequest) { // non IE
      http_request = new XMLHttpRequest();
    }
    else if (window.ActiveXObject) { //
      try {
        http_request = new ActiveXObject(&quot;Microsoft.XMLHTTP&quot;);
      }
      catch (error) {}
    }
    if (!http_request) {
      alert('Cannot create XML HTTP instance');
      return false;
    }

    http_request.onreadystatechange = stateManager;
    var myurl = &quot;cgi-bin/users.php&quot;;
    var f = document.getElementById(&quot;filter&quot;);
    if (f != null) {
      if (f.value != '') {
        myurl = myurl + &quot;?filter=&quot; +  f.value;
      }
    }
    http_request.open(&quot;GET&quot;, myurl, true);
    http_request.send(null);
  }

  function stateManager() {
    if (http_request.readyState == 4) {
      if (http_request.status == 200) {
        updatepage(http_request.responseText);
      } else {
        alert('There was a problem with the request.');
      }
    }
  }

  function updatepage(str) {
    document.getElementById(&quot;userlist&quot;).innerHTML = str;
  }

  setTimeout(&quot;getusers()&quot;, 5000);
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>
<p>I have tried adding ?filter= after GET request (2) with bash commands but it hasn't done anything. Wondering what I could add to crack the page.</p>
",https://stackoverflow.com/questions/66534620/how-to-hack-this-url-with-burpsuite,"['javascript', 'get', 'http-headers']",128,False,0,0
Running Vulnerable Web Apps in Docker,"<p>I would like to assess multiple Security Testing Tools (like OWASP ZAP) by running them against multiple <strong>vulnerable web applications</strong> (like Damn Vulnerable Web Application - DVWA).</p>
<p>I know running vulnerable web applications while being in a network connected to the web might be dangerous and not the best idea. But is it also unsafe to <strong>run these apps inside docker containers</strong>?
Would that be a good option without having to consider getting hacked or should i <strong>disconnect</strong> from the web while running these apps inside docker?</p>
<p>Unfortunately, i dont know much about how abstracted a docker image is from the rest of my pc and what possibilities a pwned server inside a docker container would have. Thank you</p>
",https://stackoverflow.com/questions/70234297/running-vulnerable-web-apps-in-docker,"['docker', 'security', 'web-applications']",215,False,1,0
Assertion for a test step is not being recognized by groovy script when run on Jenkins,"<p>I have a &quot;Property Content&quot; JsonPath Existence Match assertion for a Test Step in a test case. Its a REST service and have assertion as following:</p>
<p>$.recommendedFood[0].calories</p>
<p>I have the following code <code>def assertsize = testStep.getAssertionList().size()</code></p>
<p>This works fine when i print out running the groovy script on SOAP UI ( locally)<code>log.info (testStep.getAssertionList().size())</code> output is 1</p>
<p>But the same when run on Jenkins, the size is printed as 0( no change in the script, but it doesnt recognize the test step.</p>
<p>Also i see error <code>23:41:42,500 ERROR [TestAssertionRegistry] Missing assertion for type [JsonPath Existence Match]</code></p>
<p>I tried solutions : <a href=""https://stackoverflow.com/questions/26388320/soapui-testrunner-giving-error-about-testassertionregistry"">SoapUI Testrunner giving error about TestAssertionRegistry</a></p>
<p><a href=""https://community.smartbear.com/t5/API-Functional-Security-Testing/Maven-Soapui-Plugin-with-json-assertions-does-not-work-well-in/td-p/106777"" rel=""nofollow noreferrer"">https://community.smartbear.com/t5/API-Functional-Security-Testing/Maven-Soapui-Plugin-with-json-assertions-does-not-work-well-in/td-p/106777</a></p>
<p>but could not solve the issue. Any solutions or fixes for that?</p>
",https://stackoverflow.com/questions/66251862/assertion-for-a-test-step-is-not-being-recognized-by-groovy-script-when-run-on-j,"['json', 'maven', 'jenkins', 'soapui', 'assertion']",84,False,1,0
Owasp Zap and Amazon,"<p>I don't have much experience of penetration testing, but I am currently looking at OWASP Zap.</p>
<p>The website I am going to pentest runs on an Amazon EC2 instance. Amazon seems to have certain requirements when it comes to security testing:
<a href=""https://aws.amazon.com/security/penetration-testing/"" rel=""nofollow noreferrer"">https://aws.amazon.com/security/penetration-testing/</a></p>
<p>The above website says that you can run security tests on a Amazon EC2 instance but not certain ones such as DNS zone walking, DoS, etc. which is fair enough.</p>
<p>The problem is that I can't see exactly what OWASP Zap will do when I click the &quot;Attack&quot; button and I obviously don't want to upset AWS!</p>
<p>Has anyone else used OWASP Zap on an EC2 instance? Did it you have to configure it to not do DoS attacks, etc? Is there any way I can find out what Zap is doing (I couldn't see anything in the documentation but may have missed something)?</p>
",https://stackoverflow.com/questions/67911787/owasp-zap-and-amazon,"['amazon-web-services', 'amazon-ec2', 'owasp', 'penetration-testing', 'penetration-tools']",509,True,0,1
Preventing DLL injection in jpackage generated EXE,"<p>As the title states, is there a way to prevent DLL injections in jpackage generated binaries? I have created an EXE for a JavaFX application. During security testing of this application, it was noticed that arbitrary DLLs can be loaded during execution of the application.</p>
<p>Some remediation steps were mentioned such as:</p>
<ul>
<li>Use of <code>SearchPath</code> to identify location of library or component</li>
<li>Use of <code>LoadLibrary</code> to identify OS version</li>
<li>Use fully qualified paths for all <code>LoadLibrary</code>, <code>ShellExecute</code> and <code>CreateProcess</code> calls where possible</li>
<li>Implement calls to <code>SetDllDirectory</code> with an empty string to remove current working directory from default DLL search order where required</li>
<li>Sign executable files and verify signature before executing EXE or DLL files</li>
</ul>
<p>If my code used any of the above calls directly, I could control it. But is there any way to control these after the files have been generated?</p>
<p>P.S. I use JDK 16 and the <a href=""https://badass-runtime-plugin.beryx.org/releases/latest/"" rel=""nofollow noreferrer"">Badass Runtime Plugin</a> to generate the EXE via a Gradle task</p>
",https://stackoverflow.com/questions/69370583/preventing-dll-injection-in-jpackage-generated-exe,"['java', 'windows', 'dll-injection', 'jpackage']",174,False,3,0
How to prevent XSS attack such as onmouseover in mvc?,"<p>Lately, a penetration test is done using OWAPS ZAP tool in my application. I have not much knowledge of security testing. They found some vulnerability that is XSS Cross-Site Scripting (Persistent).</p>
<p>In the application, there is a simple module that contains both getting some HTML content from users and according to content users can messaging with each other. I understand the vulnerability that occurs while getting HTML codes from users and decode them with <code>@Html.Raw(content)</code>. HtmlSanitizer fixed this kind of attack such as alerting with using a script (&lt;script alert(1); /script&gt;) in my application.</p>
<p>But I confused at some point. The other vulnerability arose while getting user's messages. It attacks with sending message 'onMouseOver=alert(1);' as input. My application takes this input as normal text and shows the message as text. I showed the messages also with razor-like <code>@message.content</code> and I didn't use any @Html attributes.</p>
<p>I don't understand the vulnerabilities sending onMouseOver=alert(1); as input. What could be the problem?</p>
",https://stackoverflow.com/questions/66693666/how-to-prevent-xss-attack-such-as-onmouseover-in-mvc,"['asp.net', 'model-view-controller', 'xss', 'owasp']",334,False,2,0
Sending low level raw HTTP/HTTPS requests in node JS,"<p>I am in the process of writing an intercepting proxy tool like <a href=""https://portswigger.net/burp"" rel=""nofollow noreferrer"">Burpsuite</a> for security testing. An important part of that would be sending malformed HTTP requests in the case of which we would have to give the user full control over the request!</p>
<p>So, I can't have complete control while using a library! I need to be able to send raw HTTP requests to the target hosts like,</p>
<pre><code>GET / HTTP/1.1
Host: google.com
</code></pre>
<h3>My attempt :-</h3>
<p>I tried using the node JS <a href=""https://nodejs.org/api/net.html"" rel=""nofollow noreferrer"">net module</a>, and I was able to connect to host on port 80 (<em>HTTP</em>), and while connecting to port 443 (<em>HTTPS</em>), a connection is established but returns an empty response!</p>
<p>On some researching, I found out that this has something to do with SSL, as I tried telnet and it too failed for <em>HTTPS</em> connections and by looking at some stackoverflow answers!</p>
<p>Is there any option through which I can directly send raw HTTP/HTTPS requests directly from my node application?</p>
<p>Thanks!</p>
",https://stackoverflow.com/questions/66842858/sending-low-level-raw-http-https-requests-in-node-js,"['node.js', 'sockets', 'http', 'ssl', 'https']",800,True,1,1
OWASP ZAP - Unable to intercept SOAP API requests,"<p>I am new to the ZAP and trying to pen test XML(SOAP) services. I already have Java based regression tests for the SOAP and trying to proxy them through ZAP, but unable to do so.</p>
<p>I am looking for some guidance as how to successfully use my regression tests to perform security testing on SOAP services using ZAP?</p>
<p><em><strong>Details:</strong></em></p>
<p>I add following parameters to Java in my regression tests so that they may successfully connect to SOAP services:</p>
<pre><code>System.setProperty(&quot;javax.net.ssl.trustStore&quot;, &quot;C:/standalone/configuration/app.keystore&quot;); // certificate
System.setProperty(&quot;javax.net.ssl.trustStorePassword&quot;, &quot;somepassword&quot;); // password
</code></pre>
<p>ZAP is starting up with following command-line and able to intercept other browser calls proxying through localhost:8888:</p>
<pre><code>zap.bat -host localhost -port 8888 -config api.addrs.addr.regex=true -config api.key=12345 -config connection.timeoutInSecs=60
</code></pre>
<p>But when I try to run regression tests with following proxy settings, they completely ignore ZAP as proxy and run just fine with or without ZAP server running:</p>
<pre><code>System.setProperty(&quot;http.proxyHost&quot;, &quot;localhost&quot;);     System.setProperty(&quot;http.proxyPort&quot;, &quot;8888&quot;);          
System.setProperty(&quot;https.proxyHost&quot;, &quot;localhost&quot;);     System.setProperty(&quot;https.proxyPort&quot;, &quot;8888&quot;);
</code></pre>
<p>Then I added SOCKs proxy settings in regression tests:</p>
<pre><code>System.setProperty(&quot;socksProxyHost&quot;, &quot;localhost&quot;);
System.setProperty(&quot;socksProxyPort&quot;, &quot;8888&quot;);
</code></pre>
<p>Now, I get following error in tests:</p>
<pre><code>16:52:00.623 [main] ERROR com.dummy.client.ServiceClient - java.net.SocketException: Can't connect to SOCKS proxy:Connection refused: connect
java.net.SocketException: Can't connect to SOCKS proxy:Connection refused: connect
    at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:428) ~[?:1.8.0_211]
    at java.net.Socket.connect(Socket.java:589) ~[?:1.8.0_211]
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:339) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.5.jar:4.5.5]
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.5.jar:4.5.5]
    at com.dummy.client.AppHttpClient.request(AppHttpClient.java:83) ~[appc3-ws-client-12.00.01.jar:?]
    at com.dummy.stub.ServiceStub.authorization(ServiceStub.java:89) ~[appc3-ws-client-12.00.01.jar:?]
    at com.dummy.client.ServiceClient.doAuthorization(ServiceClient.java:367) ~[appc3-ws-client-12.00.01.jar:?]
    at com.dummy.client.ServiceClient.doAuthorization(ServiceClient.java:397) ~[appc3-ws-client-12.00.01.jar:?]
    at com.dummy.ca.reusable.WebService.authorization(WebService.java:65) ~[main/:?]
    at com.dummy.ca.reusable.WebService.Change(WebService.java:657) ~[main/:?]
    at com.dummy.ca.StepsLibrary.T3_Poster.changeDevice(T3_Poster.java:238) ~[main/:?]
    at com.dummy.ca.stepDefinations.PosterUpdatePD.change(PosterUpdatePD.java:219) ~[main/:?]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_211]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_211]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_211]
    at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_211]
    at io.cucumber.java.Invoker.doInvoke(Invoker.java:66) ~[cucumber-java-6.1.2.jar:6.1.2]
    at io.cucumber.java.Invoker.invoke(Invoker.java:24) ~[cucumber-java-6.1.2.jar:6.1.2]
    at io.cucumber.java.AbstractGlueDefinition.invokeMethod(AbstractGlueDefinition.java:44) ~[cucumber-java-6.1.2.jar:6.1.2]
    at io.cucumber.java.JavaHookDefinition.execute(JavaHookDefinition.java:59) ~[cucumber-java-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.CoreHookDefinition.execute(CoreHookDefinition.java:44) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.HookDefinitionMatch.runStep(HookDefinitionMatch.java:21) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.TestStep.executeStep(TestStep.java:92) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.TestStep.run(TestStep.java:63) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.TestCase.run(TestCase.java:102) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runner.Runner.runPickle(Runner.java:71) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runtime.Runtime.lambda$execute$5(Runtime.java:110) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runtime.CucumberExecutionContext.runTestCase(CucumberExecutionContext.java:131) ~[cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.runtime.Runtime.lambda$execute$6(Runtime.java:110) ~[cucumber-core-6.1.2.jar:6.1.2]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[?:1.8.0_211]
    at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[?:1.8.0_211]
    at io.cucumber.core.runtime.Runtime$SameThreadExecutorService.execute(Runtime.java:233) ~[cucumber-core-6.1.2.jar:6.1.2]
    at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:112) ~[?:1.8.0_211]
    at io.cucumber.core.runtime.Runtime.lambda$run$2(Runtime.java:86) ~[cucumber-core-6.1.2.jar:6.1.2]
    at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) [?:1.8.0_211]
    at java.util.stream.SliceOps$1$1.accept(SliceOps.java:204) [?:1.8.0_211]
    at java.util.ArrayList$ArrayListSpliterator.tryAdvance(ArrayList.java:1359) [?:1.8.0_211]
    at java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:126) [?:1.8.0_211]
    at java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:498) [?:1.8.0_211]
    at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:485) [?:1.8.0_211]
    at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) [?:1.8.0_211]
    at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) [?:1.8.0_211]
    at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) [?:1.8.0_211]
    at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) [?:1.8.0_211]
    at io.cucumber.core.runtime.Runtime.run(Runtime.java:87) [cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.cli.Main.run(Main.java:78) [cucumber-core-6.1.2.jar:6.1.2]
    at io.cucumber.core.cli.Main.main(Main.java:33) [cucumber-core-6.1.2.jar:6.1.2]
</code></pre>
<p>And ZAP command-line shows below Socket timeout warning, whenever I fire regression:</p>
<pre><code>6862 [ZAP-BootstrapGUI] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Tips and Tricks
6868 [ZAP-BootstrapGUI] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz WebSocket messages.
7259 [ZAP-BootstrapGUI] INFO  org.zaproxy.zap.extension.callback.ExtensionCallback - Started callback server on 0.0.0.0:61252
7260 [ZAP-BootstrapGUI] INFO  org.zaproxy.zap.extension.keyboard.ExtensionKeyboard - Initializing keyboard shortcuts
9203 [AWT-EventQueue-0] INFO  org.parosproxy.paros.control.Control - New Session
9212 [AWT-EventQueue-0] INFO  org.parosproxy.paros.control.Control - Create and Open Untitled Db
9219 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache commit start
9221 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache commit end
9231 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - Database closed
9398 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open start
9402 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache commit start
9407 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache commit end
9408 [AWT-EventQueue-0] INFO  hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open end
40538 [ZAP-ProxyThread-1] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Socket timeout while reading first message.
50575 [ZAP-ProxyThread-2] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Socket timeout while reading first message.
60604 [ZAP-ProxyThread-3] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Socket timeout while reading first message.
70630 [ZAP-ProxyThread-4] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Socket timeout while reading first message.
80679 [ZAP-ProxyThread-5] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Socket timeout while reading first message.
</code></pre>
",https://stackoverflow.com/questions/69060533/owasp-zap-unable-to-intercept-soap-api-requests,"['proxy', 'soap-client', 'client-certificates', 'zap', 'penetration-testing']",390,False,0,0
How do new features/changes in azure data factory become available?,"<p>Suppose I start using Azure Data Factory today, at some point the tool is likely to see improvements or other changes. Note that I am not talking about what I do inside the tool, but I am talking about the Data Factory itself. How will these changes become available to me?</p>
<ol>
<li>Will I be able to look at the changes before they happen (and how long)?</li>
<li>Will I be able to stay on an old version if I do not like the new one or have not finished testing (e.g. security testing)?</li>
<li>Is there any indication of how often changes are rolled out? (Every year, 10x per day)</li>
</ol>
<p>Does any of the above depend on the type of change (big, small, feature/bug/vulnerability).</p>
<p>I suspect that people have this question for many similar tools, so though I am specifically interested in the Azure Data Factory at this time, an indication of whether the answer applies to other types of solutions (within Azure or perhaps it is even similar for other vendors) would be useful.</p>
",https://stackoverflow.com/questions/69392498/how-do-new-features-changes-in-azure-data-factory-become-available,"['azure', 'cloud', 'azure-data-factory', 'lifecycle']",39,True,0,1
Use of a one-way hash without a salt while fixing Download of code without Integrity check issue Checkmarx,"<p>I am trying to load some library &quot;.so&quot; / &quot;.dll&quot; files using below code</p>
<pre><code>System.load(&quot;some file&quot;);
</code></pre>
<p>then after performing Static application security testing (SAST) using <strong>checkmarx</strong> tool
it is complaining Download of Code Without Integrity Check issue.</p>
<p>then I tried to fix the <strong>Download of Code Without Integrity Check</strong> SAST issue using checksum</p>
<p>I generated a library file checksum using a sha-512 algorithm and kept it in a String constant</p>
<pre><code> public static final String TRUSTED_SHA512 = &quot;12af30d9ffc1cdd85d21e73c8c81b7c379a9b4ab2ea5676cd9d232788e2b44fbab876796104f37d0f6a5f7bc5f97eb3663e432785b94039b5320bbfac3d19516&quot;;
</code></pre>
<p>now before loading the file, I am computing hash again with the same algorithm and checking it against String constant <strong>TRUSTED_SHA512</strong></p>
<pre><code> MessageDigest md = MessageDigest.getInstance(&quot;SHA-512&quot;);
        String sha512ofQrcToolsWrapper = ChecksumHelper.getFileChecksum(md,temp);
        if(sha512ofQrcToolsWrapper.equalsIgnoreCase(ServiceConstants.TRUSTED_SHA512_OF_QRCTOOLSWRAPPER)) {
            System.load(temp.getAbsolutePath());
        }else{
            throw new Exception(&quot;failed to load windows dll file : Checksum mismatched&quot;);
        }
</code></pre>
<p>Now checkmarx tool is giving <strong>one more issue Use of a one-way hash without a salt</strong>
then i updated message digest with static salt value. The
reason behind using fix salt value instead of random value is that we want to compute same hash at runtime to check with the one already there in constant</p>
<pre><code> public static String getFileChecksum(MessageDigest digest, File file) throws IOException, NoSuchAlgorithmException {
    //Get file input stream for reading the file content
    FileInputStream fis = new FileInputStream(file);

    //Create byte array to read data in chunks
    byte[] byteArray = new byte[1024];
    int bytesCount = 0;

    //Read file data and update in message digest
    while ((bytesCount = fis.read(byteArray)) != -1) {
        digest.update(byteArray, 0, bytesCount);
    }

    //Static salt value
    digest.update(getSalt());
    
    //close the stream; We don't need it now.
    fis.close();

    //Get the hash's bytes
    byte[] bytes = digest.digest();

    //This bytes[] has bytes in decimal format;
    //Convert it to hexadecimal format
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i &lt; bytes.length; i++) {
        sb.append(Integer.toString((bytes[i] &amp; 0xff) + 0x100, 16).substring(1));
    }

    //return complete hash
    return sb.toString();
}
</code></pre>
<p>NOTE &quot;getSalt() method is returning byte array with fixed values&quot;</p>
<p>Still, checkmarx SAST is complaining both the issues</p>
<ol>
<li>Download of code without Integrity check</li>
<li>Use of a one-way hash without a salt</li>
</ol>
<p>please provide solution to fix these issues. let me know if anything else needed to clarify.</p>
<p>Thanks in advance</p>
",https://stackoverflow.com/questions/66966544/use-of-a-one-way-hash-without-a-salt-while-fixing-download-of-code-without-integ,"['java', 'spring', 'security', 'password-hash', 'checkmarx']",835,False,0,0
MethodArgumentTypeMismatchException - custom error message?,"<p>I have a spring boot app which returns JSON.</p>
<p>In one of its methods, it has an <code>Integer</code> parameter (@RequestParam).</p>
<p>While doing security testing they called my method with some JS code passed in<br />
(instead of an integer value).</p>
<pre><code>2021-07-01 04:59:14.995  WARN [tpe-rcf,2ff110026bf0649e,2ff110026bf0649e,false] 12800 
--- [nio-8080-exec-1] .w.s.m.s.DefaultHandlerExceptionResolver :   
Resolved [org.springframework.web.method.annotation.MethodArgumentTypeMismatchException:   
Failed to convert value of type 'java.lang.String' to required type 'java.lang.Integer';    
nested exception is java.lang.NumberFormatException: For input string: &quot;&lt;script&gt;alert(11355545)&lt;/script&gt;&quot;]
</code></pre>
<p>I am getting this error above in the console of my app.</p>
<p>This is then sent to the browser in some JSON which looks like this:</p>
<pre><code>{

... 

&quot;message&quot;: &quot;Failed to convert value of type 'java.lang.String' to required type 'java.lang.Integer'; nested exception is java.lang.NumberFormatException: For input string: \&quot;&lt;script&gt;alert(11355545)&lt;/script&gt;\&quot;&quot;,

&quot;path&quot;: &quot;/a/b/c&quot;

}
</code></pre>
<p>My question is if it's possible to override the error message e.g. by replacing the <code>&lt;</code> with <code>\u003c</code> in the JSON that's returned to the browser.</p>
<p>The security testers claim I should sanitize the JSON returned (i.e. escape these <code>&lt;</code> symbols) since that may pose some issues for older browsers (i.e. get this JS code executed in them).</p>
<p>But it's the SpringBoot framework who generates the error message,<br />
I have no much control here.</p>
<p>Of course I can define the parameter as String and do the validation myself but I doubt that is the right way. My parameter is defined as Integer and I prefer it stays that way.</p>
<p>So my question is how to do this escaping/sanitizing? I tried using <code>@ControllerAdvice</code> and override <code>ResponseEntityExceptionHandler</code> but no much luck so far.</p>
<p>I think if there's a way it should be quite simple.</p>
<p>What is the easiest way of doing this?</p>
",https://stackoverflow.com/questions/68207463/methodargumenttypemismatchexception-custom-error-message,"['java', 'spring', 'spring-boot']",862,True,1,1
"Mobile authentication approaches, JWTs and refresh tokens","<h4>Context</h4>
I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the browser.
<p>The REST Api currently authenticates users by returning access and refresh tokens in form of JWTs. Both local (username/password) and OAuth2.0 (only Google at the moment) flows are available, as I provide the user with these two different options for authenticating.</p>
<h4>Problem</h4>
The flows that follow are working just fine when the API is called from the webclient, but now that we've started developing the mobile app a big question arised: **how do we keep the user authenticated on the mobile app even after the refresh token expires?** 
<p>All the famous apps out there do not prompt the user to authenticate let's say weekly or worst daily, but still I'm sure their authentication practices are (almost) flawless.</p>
<h4>Tried paths</h4>
I've read many blog posts and articles, together with some StackExchange Q&As as reported below, but the right way to approach authentication and access persistence on mobile is still unclear.
<ul>
<li><p>Should I create a specific endpoint (or many) to provide non-expiring tokens only when the <code>User-Agent</code> header tells the API is being called by a mobile device?</p>
</li>
<li><p>As mentioned in <a href=""https://stackoverflow.com/questions/26739167/jwt-json-web-token-automatic-prolongation-of-expiration"">JWT (JSON Web Token) automatic prolongation of expiration</a> Auth0 abandoned JWT for mobile in favor of random generated strings. What implementations are available in this case? Should I use this string as a never-ending id of the authenticated device and approve all API calls that have it attached?</p>
</li>
<li><p>In the OAuth case, should I perform (I don't know how) silent calls to the OAuth provider to get back a new idToken and then request new tokens to my own API with it?</p>
</li>
<li><p>In the local case, should I keep user credentials stored locally? If so, how do I do that securely?</p>
</li>
</ul>
<p>Consulted resources</p>
<ul>
<li><a href=""https://stackoverflow.com/questions/17427707/whats-the-right-oauth-2-0-flow-for-a-mobile-app"">What&#39;s the right OAuth 2.0 flow for a mobile app</a></li>
<li><a href=""https://stackoverflow.com/questions/27726066/jwt-refresh-token-flow"">JWT refresh token flow</a></li>
<li><a href=""https://stackoverflow.com/questions/33699378/authenticating-a-mobile-application-with-jwt-and-refresh-tokens"">Authenticating a mobile application with JWT and refresh tokens</a></li>
<li><a href=""https://softwareengineering.stackexchange.com/questions/318471/jwt-refresh-token-exponentially"">https://softwareengineering.stackexchange.com/questions/318471/jwt-refresh-token-exponentially</a></li>
<li><a href=""https://auth0.com/docs/best-practices/mobile-device-login-flow-best-practices"" rel=""nofollow noreferrer"">https://auth0.com/docs/best-practices/mobile-device-login-flow-best-practices</a></li>
<li><a href=""https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/"" rel=""nofollow noreferrer"">https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/</a></li>
<li><a href=""https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"" rel=""nofollow noreferrer"">https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management</a></li>
<li><a href=""https://tech.justeattakeaway.com/2019/12/04/lessons-learned-from-handling-jwt-on-mobile/"" rel=""nofollow noreferrer"">https://tech.justeattakeaway.com/2019/12/04/lessons-learned-from-handling-jwt-on-mobile/</a> (more focused on improving an already established architecture)</li>
</ul>
<p>...and many more I'm not reporting as outside the scope of the question.</p>
<p>This question was originally posted here, <a href=""https://softwareengineering.stackexchange.com/questions/430302/mobile-authentication-approaches-jwts-and-refresh-tokens/430315#430315"">https://softwareengineering.stackexchange.com/questions/430302/mobile-authentication-approaches-jwts-and-refresh-tokens/430315#430315</a></p>
<h4>Some diagrams</h4>
These are the flows we've currently implemented, working as espected when the API is consumed by a webclient.
<p><em>Local</em>
<a href=""https://i.stack.imgur.com/HXLQP.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/HXLQP.png"" alt=""Local flow"" /></a></p>
<hr />
<p><em>OAuth2.0</em>
<a href=""https://i.stack.imgur.com/ddCaL.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/ddCaL.png"" alt=""OAuth2.0 with Google provider flow"" /></a></p>
",https://stackoverflow.com/questions/68411366/mobile-authentication-approaches-jwts-and-refresh-tokens,"['authentication', 'mobile', 'architecture', 'jwt', 'refresh-token']",716,True,0,1
Conditional Left Join w/ PowerQuery - Large Dataset,"<h2>Here's the PowerQuery problem</h2>
<p><em>(Static Application Security Testing) SAST Scanner --- gives ---&gt; Vuln, Line #, File Path, etc.</em></p>
<p><em>Mapped Test Suite for Scanner --- gives ---&gt; Function, Line Start, Line End, File Path, etc.</em></p>
<p>I put all the data in Excel.</p>
<p><strong>Now I need to connect the 'Scanner' data w/ the 'Test Suite Map' data</strong></p>
<p>Example Tables of datasets:</p>
<hr />
<p><strong>Scanner</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>Vuln Desc</th>
<th>Line #</th>
<th>File Path</th>
</tr>
</thead>
<tbody>
<tr>
<td>SQL Injection</td>
<td>5</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
</tr>
<tr>
<td>SQL Injection</td>
<td>15</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
</tr>
</tbody>
</table>
</div><hr />
<p><strong>Map</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>Function</th>
<th>Line Start</th>
<th>Line End</th>
<th>File Path</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bad_Function()</td>
<td>1</td>
<td>10</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
</tr>
<tr>
<td>Good_Function()</td>
<td>11</td>
<td>20</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
</tr>
</tbody>
</table>
</div><hr />
<p>I'm using this process to analyze how many &quot;Good&quot; (False Positive) and &quot;Bad&quot; (True Positive) functions are being detected by the scanners.</p>
<p>I'm trying to do this with PowerQuery and using their &quot;M&quot; language.
I've tried to use some of the &quot;M&quot; language docs and also <a href=""https://p3adaptive.com/2019/02/powerquerymagic-conditional-joins-using-table-selectrows/"" rel=""nofollow noreferrer"">https://p3adaptive.com/2019/02/powerquerymagic-conditional-joins-using-table-selectrows/</a>.</p>
<p><strong>However,</strong> these are not working...results below.</p>
<ol>
<li><p>Go into Power Query</p>
</li>
<li><p>Create a Custom Column for the 'Scanner' table</p>
</li>
</ol>
<p><a href=""https://i.stack.imgur.com/2UytM.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/2UytM.png"" alt=""Custom Column"" /></a></p>
<ol start=""3"">
<li>&quot;M&quot; Code as &quot;Custom Column Formula&quot;</li>
</ol>
<pre><code>    Table.SelectRows(Map, (map_ref)=&gt; 
    ([#&quot;Line #&quot;]&gt;=map_ref[Line Start] 
    and [#&quot;Line #&quot;]&lt;=map_ref[Line End] and [File Path]=map_ref[File Path]))

</code></pre>
<p><a href=""https://i.stack.imgur.com/JRpmz.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/JRpmz.png"" alt=""Power Query Code Example"" /></a></p>
<ol start=""4"">
<li>I expand the new column into the matched 'Map' columns</li>
</ol>
<p>This works for the test set of data here</p>
<p><strong>Scanner (Left Joined w/Map)</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>Function</th>
<th>Line #</th>
<th>File Path</th>
<th>Scanner to Map.Function</th>
</tr>
</thead>
<tbody>
<tr>
<td>SQL Injection</td>
<td>5</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
<td>Bad_Function()</td>
</tr>
<tr>
<td>SQL Injection</td>
<td>15</td>
<td>\TestSuite\CWE89\sql_injection.cs</td>
<td>Good_Function()</td>
</tr>
</tbody>
</table>
</div><hr />
<p><strong>The problem is that it doesn't work for my actual data</strong></p>
<p>Some thing to mention that I've already fixed:</p>
<ul>
<li>I already made sure the file paths will match up</li>
</ul>
<h2><em><strong>My Actual Tables (smaller dataset - that works)</strong></em></h2>
<p><strong>VCG_juliet_test_results_csharp</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>Type Name</th>
<th>File Path</th>
<th>Line</th>
</tr>
</thead>
<tbody>
<tr>
<td>SQL Injection</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_05.cs</td>
<td>321</td>
</tr>
<tr>
<td>SQL Injection</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_06.cs</td>
<td>117</td>
</tr>
</tbody>
</table>
</div>
<p><strong>juliet_test_suite_csharp_map</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>filepath</th>
<th>type</th>
<th>line_start</th>
<th>line_end</th>
</tr>
</thead>
<tbody>
<tr>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_05.cs</td>
<td>secondary good</td>
<td>255</td>
<td>334</td>
</tr>
<tr>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_06.cs</td>
<td>secondary good</td>
<td>94</td>
<td>130</td>
</tr>
</tbody>
</table>
</div>
<p>As you can see, these functions should also match up.  The line numbers are in between the line numbers of the second table.  Therefore, the &quot;Conditional Left Join&quot; should work here.</p>
<p>(Using Add Column in Power Query)
<strong>Custom Code to do Conditional Join</strong>*</p>
<pre><code>Table.SelectRows(juliet_test_suite_csharp_map, (map_ref)=&gt; ([Line]&gt;=map_ref[line_start] 
    and [Line]&lt;=map_ref[line_end] and [File Path]=map_ref[filepath]))
</code></pre>
<p><a href=""https://i.stack.imgur.com/b3sso.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/b3sso.png"" alt=""Custom Column - Conditional Left Join"" /></a></p>
<p><strong>VCG_juliet_test_results_csharp (joined w/ test suite map)</strong></p>
<div class=""s-table-container"">
<table class=""s-table"">
<thead>
<tr>
<th>Type Name</th>
<th>File Path</th>
<th>Line</th>
<th>Juliet Mapping.filepath</th>
<th>Juliet Mapping.type</th>
<th>Juliet Mapping.line_start</th>
<th>Juliet Mapping.line_end</th>
</tr>
</thead>
<tbody>
<tr>
<td>SQL Injection</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_05.cs</td>
<td>321</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_05.cs</td>
<td>secondary good</td>
<td>255</td>
<td>334</td>
</tr>
<tr>
<td>SQL Injection</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_06.cs</td>
<td>117</td>
<td>C:\Users\User_Name\Documents\SAST Benchmarking\juliet_test_suite_1.3-csharp\src\testcases\CWE319_Cleartext_Tx_Sensitive_Info\CWE319_Cleartext_Tx_Sensitive_Info__NetClient_SqlConnection_06.cs</td>
<td>secondary good</td>
<td>94</td>
<td>130</td>
</tr>
</tbody>
</table>
</div><hr />
<p><em><strong>It does work here, but when we do it on a larger dataset w/ the same format we get this.</strong></em></p>
<p><a href=""https://i.stack.imgur.com/6lSin.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/6lSin.png"" alt=""all null values"" /></a></p>
<p>Some extra info:</p>
<ul>
<li>the data set is around 216,000 rows</li>
</ul>
<p>Above picture:</p>
<ul>
<li>When I expand the column I get all null values</li>
<li>When I close and load, it loads about 3 rows a second.  There are <strong>200,000</strong> rows so that would take 18.5 hours!! (my math might be off there)</li>
</ul>
<p><strong>Conclusion</strong></p>
<ul>
<li>My conditional left join works on smaller datasets w/ the same formatting and same add column formula</li>
<li>In Power Query after expanding the column, I'm left with all null values.  Although, closing and loading the query causes it to load at super slow speeds</li>
<li>The problem might be the large dataset, and maybe Power Query isn't made for this.  I might have to write a manual program for this larger dataset</li>
</ul>
<p>Would like to here from people more versed in Power Query and solving these types of problems.  If there is anymore info I can give you about how I'm doing feel free to ask, and I can edit my question.</p>
",https://stackoverflow.com/questions/70281106/conditional-left-join-w-powerquery-large-dataset,"['excel', 'left-join', 'powerquery']",92,False,1,0
