Tag Info

New answers tagged

0

Try inserting ' + alert('xxx') + ' This will render the sourcecode above as pagename : '' + alert('xxx') + '' This means in plain English "The value of _TM.pagename is the string which you get when you concatenate an empty string, the return value of calling alert('xxx') and another empty string". To build this string, alert('xxx') will be called. ...


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...


3

Null byte injection in filenames was fixed in Java 7 update 40 (released around Sept. 2013). So, its FINALLY fixed.


0

You should really avoid doing cryptography in javascript. The short reason is because you cannot trust a javascript program. The long answer can be found here: http://matasano.com/articles/javascript-cryptography/ https://bren2010.github.io/2014/06/17/javascript-crypto.html Even if you web application is written to be secure against XSS, CSRF, etc. ...


0

Check the jsencrypt project. If you use nodejs I recommend node-rsa module.


0

Export from JKS to PKCS #12. keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12 -srcalias <jkskeyalias> -deststorepass <password> -destkeypass <password> Export certificate. openssl pkcs12 -in keystore.p12 -nokeys -out cert.pem Export unencrypted private key. openssl pkcs12 -in ...


1

You should look into OWASP's App Sensor project; it is doing exactly the type of things you are talking about. Its more a proof of concept / example implementation, but the idea works and has a lot of merit. The project is focused on defining detection points and potential actions; they feel that each site should setup the rules between the two. We all ...



Top 50 recent answers are included