Most Dangerous Web App Security Risks

Injection Flaws

Injection flaws allow attackers to relay malicious code through Web apps to another system, such as backend databases or the operating system. To remedy this, organizations can use commercial WAFs (Web application firewalls), which can include negative security signatures to identify attack payloads, according to Ryan Barnett, director of application research at Breach Security. By analyzing the outbound pages, WAFs can also identify when an injection flaw is successful by identifying information leakages.

Cross-Site Scripting

Though listed separately, Cross-Site Scripting attacks are a type of injection problem that exists when malicious scripts are injected into legitimate Websites. To deal with the issue, organizations should focus on developing proper input validation policies.

Broken Authentication and Session Management

Strong authentication mechanisms can be undermined by poor credential management tied to functions such as password changes and recovery. Organizations should strive to create a single set of strong authentication and session management controls.

Insecure Direct Object Reference

A direct object reference is when a developer exposes a reference to an internal implementation object, such as a file or directory, as a URL or form parameter. An attacker can manipulate direct object references to access other objects without authorization.

Cross-Site Request Forgery

CSRF (Cross-site request forgery) occurs when a Web app fails to properly verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. To prevent CSRF, include an unpredictable token in a hidden field as part of each transaction, OWASP recommends. There should be a unique token for every user session at minimum but can also be unique per request.

Security Misconfiguration

An unsecure configuration for the application, framework, Web server, application server and/or platform can spell disaster. These settings should be well-defined and relatively easy to deploy to another environment. Ideally, this process should be automated to minimize the effort required to set up a new, secure environment.

Insecure Cryptographic Storage

Web applications that do not use appropriate encryption for sensitive information such as social security numbers and credit card information leave users open to compromise in the event of an attack. Organizations should take stock of the threat landscape and make sure sensitive data is protected. Also off-site backups should be encrypted, with the keys managed and stored separately.

Failure to Restrict URL Access

According to OWASP, many Web applications check URL access rights before rendering protected links and buttons. However, applications should perform similar checks when these pages are accessed, or attackers will be able to forge URLs to access these hidden pages anyway. Controlling URL access also includes setting proper access rate thresholds (anti-automation) to identify/prevent denial of service, brute force and scraping attacks, said Ryan Barnett, director of application research at Breach Security.

Insufficient Transport Layer Protection

Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications. When they do, they sometimes support weak algorithms, use expired or invalid certificates, or do not use them correctly. To prevent this, consider requiring SSL (Secure Sockets Layer) for certain pages and making non-SSL requests to those pages redirect to a SSL page.

Unvalidated Redirects and Forwards

This is new to OWASP's list. Web applications frequently redirect and forward users to other pages and Websites. If untrusted data is used to determine the destination pages, attackers could redirect victims to malicious sites. Again, the answer to this lies with proper validation.

from: eweek

Read more...

20 Twitter Applications You Need to Know About

With more than 50 million users visiting Twitter in July, the microblogging service has become quite the destination for short updates about what we're doing in the moment. In addition to being a hot destination, Twitter has fostered a whole new ecosystem of real-time communication. Countless applications are popping up to take advantage of the Twitter API to help make their Web services viral. Many of these services enhance the Twitter experience.
TweetMeme
TweetMeme is a service that aggregates all the popular links on Twitter to determine which links are popular. TweetMeme also makes the retweet button, which is for content publishers who want to invite their audience to tweet their content on Twitter. The button shows a live count of the number of times your Web page or blog post has been tweeted.
TweetMeNews
Hailing from nobosh labs, TweetMeNews tweets users' personalized news based on their interests. Nobosh Labs' reason for creating TweetMeNews captures the Twitter zeitgeist in a nutshell: "Nobosh has been developing a news personalization engine for over a year. As time went on Twitter exploded! Since that explosion the world has seen a convergence of information on Twitter, reducing the need to visit other sites."
TweetDeck
A super popular application, TweetDeck is a real-time Web browser that connects users to their contacts across Twitter, Facebook and other social sites. TweetDeck also boasts a version of its social application for the iPhone that geeks are giddy over.
TweetVite
TweetVite is pretty much what you'd think it would be from the name: Use it to create invitations for events you're hosting or to find local Tweetups.
TwitVid
Again, as you'd guess from the name, TwitVid lets users upload and tweet videos on Twitter.
Vidly
Another app for sharing video on Twitter, Vidly recently changed its name from Twitvid.io.
Twitoaster
Another of many, many tweet stream aggregators, Twitoaster threads and archives Twitter conversations, adding context and statistics, such as how many replies a Twitter user has received by the hour and on a weekly basis.
Tweet From Above/Tweet From Below
Tweet From Above and Tweet From Below let users send heavenly and hellish tweets anonymously.
TwitPic
You get one guess as to what TwitPic lets you do. You would not be wrong if you said it lets you share photos in tweets.
TwitBin
Twitbin is a Firefox extension that allows you to keep up with all of your Twitter conversations right from your browser sidebar.
Twitterholic
Twitterholic scans the Twitter public timeline for new twits to tweet and calculates individual statistics for each Twitter user.
Twhirl
Owned by Seesmic, Twhirl is a desktop client based on the Adobe AIR platform that lets users ... well, this slide tells it all.
Twtpoll
Another Twitter tool whose name spoils any nomenclature mystery, Twtpoll is a feedback tool that lets users create and distribute polls/surveys on Twitter, Facebook, FriendFeed or any other social media site.
Retweetist
Retweetist tracks retweets, or messages tweeted on Twitter that repeat information previously tweeted by another user.
Tweepler
Tweepler lets users separate the wheat from the chaff, helping users decide if they want to follow new followers or not.
TweetScan
TweetScan sends users e-mail when their keywords are mentioned on Twitter.
Tweetburner
For those who can't get enough of following the data flow on the links they share on Twitter, here's Tweetburner.
Twittervision
This is so cool: See who is posting what from where in real time with Twittervision, as a sort of mashup of Twitter and Google Maps.
Twibs
Twibs helps users find businesses on Twitter. Great promotional tool.
Twitdom
Finding Twitter apps can be a royal pain, particularly because so many are built by some programming shops, or even just lone wolf programmers. Twitdom is a Twitter apps database that provides a "consolidated view of all the applications developed for the Twitter ecosystem."

from: eWeek

Read more...

Do you wear contact lenses?

Contact lenses, like eyeglasses or LASIK, can correct your nearsightedness, farsightedness and astigmatism.

While some people enjoy making a fashion statement with eyeglasses, others prefer their appearance without them. Contact lenses can achieve this without irreversible refractive surgery. Contact lenses can also provide a full field of unobstructed vision, which is great for sports.

Contact lenses have been around for more than a hundred years. During that time, many advancements have allowed just about everyone to wear contact lenses. If you were told in the past that you couldn't wear contact lenses, odds are that's not true today. There are more convenient and healthy contact lens options than ever.

If you're new to contact lenses, your first step is to see an eye doctor. In the United States, contact lenses are a prescription item, just like pharmaceuticals. They must be prescribed and properly fitted by an eye care professional (ECP). Your ECP will evaluate your visual needs, your eye structure, and your tears to help determine the best type of lens for you.

The many types of contact lenses currently available can be grouped in various ways according to:

• What they're made of
• How long you wear them without removal
• How often you dispose of them
• The design of the lens

To determine which contact lens is right for you, first, your contacts must address the problem that is prompting you to wear lenses in the first place. Your contact lenses must provide good vision by correcting your myopia, hyperopia, astigmatism, or some combination of those vision problems.

Second, the lens must fit your eye. To do that, lenses come in tens of thousands of combinations of diameter and curvature. Of course, not every lens brand comes in every "size."

Your ECP is skilled in evaluating your eye's physiology, and your eyesight, to determine which lens best satisfies the two criteria above.

Third, you may have another medical need that drives the choice of lens. For example, your ECP might pick a particular lens if your eyes tend to be dry.

Finally, consider your "wish list" of contact lens features — colors, for example, or overnight wear.

When you and your ECP decide on the right lens for you, you'll be given a contact lens prescription. You'll be able to buy a supply of lenses from your ECP or from the many other outlets that sell contact lenses.

from: allaboutvision

Read more...

Keeping a Relationship

It's best to wait for the one you want than settle for the one available. Best to wait for the one you love than one who's around. Best to wait for the right one because life's too short to be wasted on just someone. "An African proverb states, "Before you get married, keep both eyes open, and after you marry, close one eye." Before you get involved and make a commitment to someone, don't let lust, desperation, immaturity, ignorance, pressure from others or a low self-esteem make you blind to warning signs. Keep your eyes open, and don't fool yourself that you can change someone or that what you see as faults aren't really that important. Once you decide to commit to someone, overtime, their flaws, vulnerabilities, pet peeves, and differences will become more obvious. If you love your mate and want the relationship to grow and evolve, you've got to learn how to close one eye and not let every little thing bother you. You and your mate have many different expectations, emotional needs, values, dreams, weaknesses, and strengths. You are two unique individual children of God who have decided to share a life together. Neither one of you are perfect, but are you perfect for each other? Do you bring out the best in each other? Do you compliment and compromise with each other, or do you compete, compare and control? What do you bring to the relationship? Do you bring past relationships, past hurt, past mistrust, past pain? You can't take someone to the altar to alter them. You can't make someone love you or make someone stay.
If you develop self-esteem, spiritual discernment, and "a life" you won't find yourself making someone else responsible for your happiness or responsible for your pain. Manipulation, control, jealousy, neediness, and selfishness are not the ingredients of a thriving, healthy, loving and lasting relationship. Seeking status, sex, and security are the wrong reasons to be in a relationship.

What keeps a relationship strong?
- communication
- intimacy
- a sense of humor
- sharing household tasks
- some getaway time without business or children
- daily exchanges (a meal, shared activity, a hug, a call, a touch, a note)
- sharing common goals and interests
- giving each other space to grow without feeling insecure
- giving each other a sense of belonging and assurances of
- asking God to be the center of your relationship

If these qualities are missing, the relationship will erode as resentment, withdrawal, abuse, neglect, dishonesty and pain replace the passion.

As long as we have memories, yesterday remains As long as we have hope, tomorrow awaits As long as we have friendship, today is beautiful."

Love is when you take away the feeling, the passion, and the romance in
a Relationship and find out that you still care for that person.

Read more...

Hairstyles that flatter your faces

Thinking of new hairstyles? Well, maybe the following can help you decide on what style will you have. The thing is you must know first what is the real shape of your face.
OVAL
Oval face shapes are perfectly in proportion, with features nicely balanced and a narrow forehead tapering into a small chin via wide, defined cheekbones. Be as daring as you wish: short, long, one-length, layers, fringes, up, off the face, or even shaved. All suit you, as you’ve no need to compensate for any dominant or weak points.
HEART
Similar to the oval, but the top half of the face is wider and narrows below the cheekbones to a delicate, yet pointed chin. Curls and waves introduced around level with the cheek bones will widen the appearance of the chin and jaw bone and make the face appear better proportioned and essentially oval.Avoid a sleek, jaw-length bobs that hug the chin, though flicked-out ends will create a more balanced outline. Again a fringe is an option.
ROUND

The face is full-cheeked and circular. Keep hair sleek at the sides and lengthen the face by choosing a hairdo with plenty of volume on top. Bardotesque ‘60s-influenced styles with a bit of backcombing at the roots are ideal.
Avoid curved or geometric styles, as they will only accentuate roundness. Also avoid hard lines and wide, block fringes that finish just above the eyebrows.
Feathered or layered hair falling onto the face will help create sleeker proportions and sweepingfringes will have a slimming effect. Keep curly hair all one length and ideally long to avoid bulk. Full curls accentuate roundness,but high ponytails and up-dos with loose tendrils around the hairline and sides are all options.
SQUARE
A broad forehead and a strong square or angular jawline dominate your face. Slim those broad cheekbones with long styles and chin-length layers. Fringes will focus attention on your eyes: opt for longer, broken up, full ones or wispy half fringes. Textured bob cuts, which fall onto the face, and curls kissing the cheeks, will both slim down the widest points of the face and help re-balance it.
LONG
Characteristically includes a high forehead, a thin face and a well-defined, long chin. Avoid one-length, straight hair and middle partings, as perfect symmetry will make any face look longer, a side parting will be much more flattering.
Keep it soft by breaking up the length with layers at eye and cheekbone level to create texture. A curly bob or long style will shorten the length of the face.
A side parting will create an illusion of fullness. If your hair has a slight wave, use a diffuser with your hairdryer to emphasize the curls, as adding volume below the chin will balance things out a bit.
ANGULAR-DIAMOND SHAPE
A fusion of square and heart proportions. Chin-length bobs and feathered, shoulder-length styles will emphasize those dramatic, angular planes while rounding out the chin. Heavy fringes are a good look,as are flicks or a mane of disheveled curls.

from: Womens journal

Read more...

Using Credit Cards Smartly

Having a credit card is a privilege and also taking responsibilities. As one of those cardholders, I want to share these tips, I've got this from a flier delivered to me together with my statement of account.

Tips to secure your Credit Card Accounts:
1. Keep a record or memorize your credit card number and your issuing bank's contact details which can be found at the back of your credit card.
2. If you are issued a PIN (Personal Identification Number) fro ATM Cash Advance Transactions, memorize it and destroy the mailer on which it was sent to you. Never change your PIN combinations that could easily be identified such as your birthday.
3. Keep a copy of your transaction receipt so you can match them against your monthly statement of account. Report any changes that you do not recognize immediately or within the designated timeline stated in your statement of account.
4. Never share your credit card details and PIN to any person. Transactions that use your credit card number and PIN may be charged to you.
5. Notify your issuing bank of any changes in your contact details and address.
6. Personally hand over your credit card to the cashier when paying for transactions.
7. Always make sure that the amount on the transaction slip is the actual amount on your purchase before you sign. Never sign a blank transaction slip.
8. Make sure to secure your card while shopping. If your card gets lost, immediately call your issuing bank to avoid paying fraudulent transactions.
9. To ensure that your are not logged on to a spoofed website, check that the URL address starts with "https". Moreover there should be a padlock icon located at the lower right portion of the web page to indicate that it is a secured website.
10. Your issuing bank will never call you to ask for your credit card or your account information. Should your receive such calls or letters, always call your issuing bank on the number at the back of your credit card for verification.
11. Endorse or sign all credit cards as soon as they are received from the bank.
12. Keep a list of your credit card company's call center/emergency hot line numbers in case of disputes, questions or to report a lost or stolen card.
13. Never allow the use of your credit card as reference (credit card number) or as an identification card.
14. Take note whether your card is held for more than the regular time. Be alert when it is not returned to you after an unusually long period.
15. Keep your credit cards in a secure place.

• It is the cardholder's responsibility to know their payment due date. The cardholder should make sure to make payment on or before this date, to avoid any penalty or late fees.
• If you have any concerns or problems with a collection agent, please report it right away to your issuing bank. Make sure you have the name of the collections agent whom you talked to and other pertinent details such as name of collections agency, date and time of call.
  

Read more...

"Love at First Sight" Thing

Do you believe in “love at first sight”? If someone’s going to ask me this kind question, I will definitely say “yes!” Why? Well, maybe because I am a hopeless romantic person and a romance novel addict. I do watch movies too, which happen to have that theme and I think it’s not bad if you fall in love for the first time you laid your eyes on a person. Why, if you have that what we call chemistry, why are you going to ignore it?

A recent study showed that the first few minutes (10 minutes below) of meeting someone has a huge influence on the course the relationship will ultimately take. Romantic relationships begin with people making judgments very quickly. Well, things do happen and if you believe in miracles then you probably believe in this saying too.

If you want to rev up your “first site” vibe and add a little spice to that few minutes, the following tips maybe can help:
1. Wear red or blue. For women who want to create an on-the-spot thrill, wearing red is the way to go. According to color experts, red is the most stimulating color you can wear. In fact, wearing or seeing red actually increases blood flow and mimics attraction.
If you’re a guy, your best bet is to go true blue. Beatrice Eiseman, Director of the Pantone Color Institute, says women are attracted to men wearing the color blue. She explains that guys who frequently wear blue are “stable, faithful and always there”. (aha, I will look for a guy wearing blue..lol)
2. Smile. Psychology and body language experts agree that smiling is one of the fastest and best ways to make you more attractive and approachable. It’s not necessary to look like you’re trying out for “Ms. Close Up Smile” but just your usual “I’m happy to be here and I’m having a fantastic time” face will do a trick. (So guys, just smile.. :))
3. Instant Chemistry. A study at the University of Chicago has shown that men associate the scents of cinnamon and vanilla with love. To kick-start your allure, women can wear a cinnamon-vanilla scented lotion or perfume. Wearing a cinnamon/vanilla blends increases the presence of pheromone-like substances and dramatically increases attraction. (i will start looking for this cinnamon/vanilla scents)

Read more...

Salary Negotiation - Tips for FAIR Pay

I have read this and loved to post for those who are jobless and looking for a job...Hope this can help for a fair salary pay...

Salary negotiations can be the most dreaded part of any job, new or old. But having the right approach can make the process much easier and less frightening.
Whatever the circumstances, experts say there are principles employees must follow for successful salary negotiation: being prepared, reasonable and confident.
Likewise,they say,there are common barriers to successful salary negotiation,including closed-mindedness and poor communication skills.

1. Always be prepared to negotiate.
Being prepared is one of the key ingredients to a successful salary negotiation, according to experts. For one, knowing your fair market value is one way of being prepared. It's always better to negotiate salary from a position of strength as provided by your data.
Consider bonuses, health insurance and other company benefits, as opposed to a better-than-average basic salary. Experts point out that there is less appetite among employers to just offer higher basic pay.
Company employers or job seekers must also be reasonable.They must have justifications for what they are asking; they must be clear and fluent about why they deserve it without sounding defensive.
Talking salary makes most people uncomfortable, experts aver, so embracing such talks often suggests confidence and establishes respect. Those who are comfortable stand out as having more self-esteem because they're willing to address an issue most people aren't willing to. Some are willing to take what they get and are hesitant to be their own advocate.

2.Don't get discouraged
Besides knowing what to do, it's also useful to know what to avoid when it comes to salary negotiations, experts say.Poor communication skills can also be a death knell. You can be brilliant, but if your delivery is poor, that works against you. How you carry yourself, elocution, grammar...all those things matter.

3. Consider negotiation before accepting a job offer.
After you receive a job offer, there is typically a lot of room to negotiate salary and benefits. Remember, salary negotiation after a job offer is the best time to take control of the situation.Once you have accepted the job offer, your chances to negotiate are typically tied to performance reviews.
source: women's journal

Read more...

Choosing your Relationship Battle

Learn how to tell what’s worth fighting for and what isn’t in a relationship.
1. Say No to Nagging
Picking at every little thing he does kills good communication. A partner may tend to “turn-off” and stop listening if you are constantly nagging him about little things. This means when there is more important thing to discuss, such as you always being the butt of his jokes at dinner parties, he may not listen.
Nagging is repetitive and generally one-sided, while a constructive discussion takes into consideration the feelings and thoughts of both parties. While you may not necessarily agree, there is more chance for a respectful outcome.
If you are constantly picking at little things, bigger issues in your relationship may take a back seat. The listener stops listening and will either block out the criticism or become angry and defensive so the interaction is hurtful.
2. Focus on the Big Issues
Experts say the major issues between couples tend to be about trust, finances, sex, child rearing and relatives. With good communication these issues can be worked through. It will take effort and guts on your part to bring them up, but if you want a happy and healthy relationship, there is no other choice than to dive in and get to the partner about one or two things, ask yourself if there are deeper issues fueling your frustration and if so, find a way to resolve them. On the other hand, as issue may seem trivial to him, but is a major thorn in your side. The key is to respect each other’s perspective on all issues and find a mutually satisfying way to resolve them.
3. Talk the talk
If you let the small stuff trump the bigger issues in your relationship, the bigger issues will eventually come back to haunt you. This means you need to talk about them. Buried resentments and disappointments wear away at the foundation of a relationship and after a period of time, a couple may give up and grow apart due to lack of understanding and closeness. Hearing the feelings of your partner and airing differences in a relationship are important to the health of the partnership. No two people are ever completely alike and need to be able to express what they feel and what they think.
4.Timing is everything
It’s all about timing when it comes to deciding to share annoyances with your partner. For example, it’s a good idea to save a talk about household issues, such as his lack of interest in dirty dishes, when he’s most likely to be receptive.
A bigger problem, such as the habit of interrupting you while you’re talking is something that can hamper successful communication and should be worked on early in a relationship. Don’t let the important issues fall by the wayside, flag them for discussion as soon as you feel hurt or upset so the issue doesn’t worsen.
source: women's journal

Read more...