31,015 reputation
1398130
bio website
location Finland
age
visits member for 2 years, 5 months
seen 3 hours ago

(+)


7h
reviewed Leave Closed Can BitTorrent be exploited? With the help of Immunity debugger or other methods?
7h
reviewed Leave Closed How does Silverlight protect the AES keys it gets from PlayReady?
7h
reviewed Close How do I allow for anonymous encryption?
7h
reviewed Close Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info
7h
reviewed Close ISO27001 Certification - Business Incident
7h
reviewed Close Extraneus message about security risk when I open a new Chrome tab
7h
reviewed Close Should I be afraid of biometric IDs?
1d
awarded  Guru
Apr
10
reviewed Reject What does this malicious JavaScript code do?
Apr
2
reviewed Reject Testing clean urls with sqlmap
Apr
2
reviewed Edit ProtonMail security concerns
Apr
2
revised ProtonMail security concerns
add source and license for image
Mar
26
awarded  Guru
Mar
23
awarded  Good Answer
Mar
23
revised Is Clickjacking a real security vulnerability?
added 73 characters in body
Mar
23
awarded  Nice Answer
Mar
23
awarded  Nice Answer
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, it's actually a lot better to just host a fake version of good.com on evil.com itself without reverse-proxying at all. This way, you can just grab the username/password without injecting any scripts in the page and possible alerting the user. Another benefit of avoiding reverse-proxying is that you, the attacker, won't have to interact with the server, and your evil.com won't appear on good.com's access logs. I honestly cannot think of a reason why reverse-proxying is beneficial to an attacker in a way other easier attacks aren't.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, then the attacks is almost meaningless. Any unauthenticated action you can get the user to perform can be done programatically without the user and from the comfort of your own computer without launching any attack. Unless there's a specific button on some website and you want as many users as possible to click that button (usually ad-clicking fraud). In that particular case (unathenticated user performing an unauthenticated action), you're correct to assume that a reverse-proxy-aided attack and a clickjacking attack are quite similar, if not essentially the same.
Mar
23
revised Is Clickjacking a real security vulnerability?
edited body