I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for. I have a simple application to view server-generated content. I want to allow the user ...
For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...