IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [runtime]

Refers to vulnerabilities or protections that only apply to software while it is running - or at the point it time when it is executed. For questions about performance, please use the tag [performance].

12 questions
10
votes
0 answers

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM unikernel thus replaces the operating system with the…
runeks
  • 393
  • 1
  • 2
  • 8
10
votes
5 answers

Can secrets be made safe in memory?

Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory? So if an attacker gets access to the remote server at…
Jus12
  • 1,315
  • 2
  • 11
  • 16
6
votes
2 answers

application runtime separation - best practise

I need to persuade "the management" that running two or more unrelated business-critital applications within a single shared runtime environment (i.e. a single "command line") is a really bad idea. Problem is the management doesn't recognise "the…
cptMikky
  • 455
  • 2
  • 5
6
votes
1 answer

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the size of their database / revocation list grows…
Mike Ounsworth
  • 57,707
  • 21
  • 150
  • 207
3
votes
1 answer

Dynamic analysis of Swift application using Cycript or gdb

I am doing analysis of a Swift iOS application. I am able to attach gdb or Cycript, but after that these tools are not able to do any method swizzling. I cant even call some method directly using Cycript, which is very easy in Objective C apps. In…
Saurabh
  • 133
  • 4
2
votes
2 answers

How to defend against a virus that hides the payload by encrypting it?

Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware: Signature-based detection Heuristic analysis Sandboxing…
user143530
2
votes
1 answer

Runtitme Error page is being displayed for XSS or SQL injection payloads

When I have manipulated the URI of an application with some SQL or XSS payloads I am able to see a runtime error page. Can we come to a conclusion that the application is vulnerable to SQL Injection or XSS attacks. Please Suggest
Sai Dutt Mekala
  • 343
  • 2
  • 10
1
vote
0 answers

What does it mean to "run a command in memory"?

If I open a terminal and use the following commands, are they "run in memory"? $ curl -s http://website.com/file.py | python - & $ command=$(curl -s http://website.com/file.py); $(echo $command | python - &) (I'm not sure that second example will…
user189912
  • 11
  • 2
1
vote
2 answers

How does Cycript / Cydia Substrate hook into processes?

I am currently doing some research on techniques about hooking mobile applications and came across some frameworks like Xposed (Android), Frida (Android and iOS) and Cycript (iOS). The documentation about Xposed and Frida is fairly good explaining…
Phoebus
  • 121
  • 4
1
vote
1 answer

How to validate the integrity of a library at run time?

I was looking at the FIPS certified version of OpenSSL and noticed that they need to execute an integrity check of the library every time it loads. As a result, the library needs to be loaded at a fixed base address to execute the validation. My…
Limit
  • 3,191
  • 1
  • 16
  • 35
0
votes
2 answers

Dynamic Application Security Testing (DAST) Scanner for Post Authentication

I am wondering if anyone know's of a DAST Scanner than can either take in an authenticated request from somewhere like burp, OR some DAST software that takes username and password and then run DAST scans against the target. I've used a ton of DAST…
Jshee
  • 121
  • 4
0
votes
1 answer

Are scripts scanned by AVs at runtime?

Are malicious scripts like (.js, .wsf, VBA macros) scanned at runtime? I noticed that if a malicious script is not detected at scantime it won't be detected at runtime either, only the downloaded file can be detected. All these scripts downloads…
William Caman
  • 3
  • 2