Tagged Questions

0
votes
1answer
198 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
10
votes
2answers
733 views

Security of Log Files - Injecting malicious code in Log files

As part of my course project I'm trying to understand various security frameworks and best practices. One of the very popular approach is to maintain Logs. My question is about the security of the ...
1
vote
1answer
503 views

HTTPS and cache injection

I understand the downside of this attack and what wrong can be done. But I dont understand how is it done ? Well, I need to educate myself, any pointers would be useful.
6
votes
2answers
809 views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
0
votes
2answers
434 views

How to encode letters in multipart/form-data to include CR/LF characters?

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like: ------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" ...