Stack Exchange
log in sign up chat discuss faq users badges

Area 51 » Technology

definition commitment beta
174
followers

IT Security

Launched Q&A site for security professionals to discuss vulnerabilities like XSS, buffer overflows, SQL injection, CSRF, clickjacking, as well as system and network security. Discussions related to OWASP projects, tools, papers, and other materials are encouraged.

Announcements

6  
Whatever - you ruined the joke. – Nathan Osman Jun 22 '10 at 21:02
4  
@Jeff, while I love this proposal, and would definitely be active in this site, I'm having a niggling that it might NOT be a good idea, that is to segregate security topics away from programmers eyes and mindset. In line with OWASP intents, it might be better to keep appsec issues back on SO to encourage developer pariticipation and awareness. – AviD Jun 22 '10 at 21:09
2  
As an example, there are some GREAT practical questions on SO wrt XSS / SQL injection and evasions, CSRF protections, secure cryptowebsystems, etc – AviD Jun 22 '10 at 21:11
show 5 more announcements

62 Example Questions (8 closed)

active newest votes
up vote 1 down vote
What PHP gotchas may lead to unexpected security vulnerabilities?
added by Chris T Aug 7 '10 at 21:16
link
up vote 0 down vote
How can an organization get started with OWASP Software Assurance Maturity Model (SAMM)? [closed]
added by Jeff Williams Jun 22 '10 at 16:49
link

closed as off topic by extropy, The Disintegrator, ygjb, Christian Hang-Hicks, Witek Aug 9 '10 at 14:13

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.
up vote 0 down vote
I heard that the OWASP project is dead or dying. Is it true? [closed]
added by WikiSpeedia hang-around Jun 22 '10 at 17:22
link

closed as off topic by Jeff Williams, Nate, William, Damovisa, Graham Lee Jul 15 '10 at 9:51

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.

Intended as off-topic. – WikiSpeedia hang-around Jun 22 '10 at 17:23
1  
It's fine to suggest improvements or provide constructive criticism to OWASP, but troll and rumor posts are off-topic. – Jeff Williams Jun 22 '10 at 17:35
up vote 0 down vote
I am getting a request for this file in my log. http://mysite:80/Content/minified/]};av.optgroup=av.op... Is this an XSS attack?
added by Igor Zevaka Jul 9 '10 at 5:20
link
2  
Not enough general relevance. Few people will search for it. Few people will be able to answer it directly. Consider a generalized form of the same question. – Thomas Ptacek Jul 21 '10 at 22:08
up vote 0 down vote
I am a truly awesome web app security guru. How can I make money testing people's web app security? [closed]
added by William Jul 13 '10 at 8:08
link

closed as off topic by Steffen Opel, WikiSpeedia hang-around, qbi, extropy, Jeff Williams Jul 19 '10 at 22:26

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.

Go work for WhiteHat Security. I hear they pay 18 US dollar per hour for good talent! – Andre Gironda Jul 18 '10 at 20:34
up vote 0 down vote
The Art of Software Security Assessment suggests three categories for code audit strategies (CC, CP, and DG). What is your experience with these?
added by Andre Gironda, edited by WikiSpeedia hang-around Jul 21 '10 at 9:42
link
I guess this will result in a lot yes and no answers. Maybe you cold write "What are your experiences?" – qbi Jul 19 '10 at 1:42
Thanks, great suggestion [changed] – Andre Gironda Jul 19 '10 at 18:14
up vote 0 down vote
One of our customers has violated our end user license agreement; is this illegal or just a breach of contract? [closed]
added by ygjb Jul 22 '10 at 3:12
link

closed as off topic by William, rem, eskatos, extropy, The Disintegrator Jul 26 '10 at 2:29

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.
up vote 0 down vote
I downloaded a Firefox plugin, but it seems to be doing wierd things in the background; how can I figure out what it's doing? [closed]
added by ygjb, edited by WikiSpeedia hang-around Jul 22 '10 at 14:14
link

closed as off topic by AviD, user13132, Erlend, scope_creep, mgv Aug 7 '10 at 18:53

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.
up vote 0 down vote
What's the best firewall for my network? [closed]
added by Erlend Jul 28 '10 at 18:59
link

closed as off topic by scope_creep, Commander Keen, Christian Hang-Hicks, Chris T, Jonas Aug 7 '10 at 23:40

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.
up vote 0 down vote
What is mass assignment in Ruby on Rails and how do I avoid it?
added by Erlend Jul 28 '10 at 19:02
link
up vote 0 down vote
What precautions should I take when choosing file permissions on a shared server?
added by Chris T Aug 7 '10 at 21:15
link
up vote 0 down vote
What does not work on XSS Remediation?
added by HDK Aug 9 '10 at 0:01
link
up vote 0 down vote
Why should I care about clickijacking?
added by HDK, edited by WikiSpeedia hang-around Aug 10 '10 at 20:32
link
up vote 0 down vote
How should I test a mobile application?
added by HDK, edited by WikiSpeedia hang-around Aug 10 '10 at 20:33
link
up vote 0 down vote
What language are used in a BlackBerry application?
added by HDK, edited by WikiSpeedia hang-around Aug 10 '10 at 20:26
link
up vote 0 down vote
Why should I care about cross-site scripting?
added by HDK, edited by WikiSpeedia hang-around Aug 10 '10 at 20:01
link
up vote 0 down vote
How can I exploit a site using a SQL injection attack?
added by Brisbe42 Aug 11 '10 at 2:21
link
up vote 0 down vote
Is it best to explicitly encode/escape all output for every context to minimize vulnerability risk? (HTML, JS, CSS, AJAX, Response Headers, etc.)
added by Tate Hansen Aug 11 '10 at 4:05
link
up vote -2 down vote
I'm attempting quantitative risk analysis of a new app I'm coding. Where can I find tables of ARO estimates or historical data for insider threats?
added by William Jul 9 '10 at 3:57
link
up vote -2 down vote
How do you map URLs to source code? (Or vice versa)
added by Andre Gironda Jul 18 '10 at 6:12
link
up vote -2 down vote
What type of a lock should I put on the door of my server room? [closed]
added by Erlend Jul 28 '10 at 18:59
link

closed as off topic by Commander Keen, Chris T, AgentConundrum, Witek, Cian Aug 10 '10 at 21:48

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.

app sec, not physical, so off-topic imo. – Commander Keen Aug 7 '10 at 19:05
Meant to be off-topic, so yes – Erlend Aug 11 '10 at 11:33
up vote -4 down vote
Hey experts, please test my app; I think it's secure: http://www.example.com/ [closed]
added by William Jul 13 '10 at 8:10
link

closed as off topic by hultqvist, Graham Lee, Steffen Opel, Jeff Atwood, qbi Jul 19 '10 at 1:43

This question does not relate to the topic of the proposal.
It was closed as part of an automated migration of off-topic to close votes on September 29, 2011.

4  
Whether this is a version of Usenet's classic "hey, you're all lamers who can't hack my site: someone.elses.site.example"; or actually a genuine request, I think it would be off-topic. – Graham Lee Jul 15 '10 at 14:50
1  
Agreed, Graham. Taking someone up on their hack-me request is also potentially illegal and we don't want to be condoning that. – William Jul 15 '10 at 23:20
1 2