Reputation
3,523
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
10 28
Newest
 Nice Answer
Impact
~228k people reached

13h
awarded  Nice Answer
Jun
5
comment CSRF With JSON POST
A little update to this - it is possible now to send the application/json POSTs cross domain with navigator.sendBeacon API - developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon
Apr
1
awarded  Yearling
Sep
30
awarded  Explainer
Jun
14
awarded  Nice Answer
Apr
5
awarded  Nice Answer
Apr
1
awarded  Yearling
Sep
11
awarded  Necromancer
Apr
1
awarded  Yearling
Oct
19
answered How to exploit DRUPAL-SA-CORE-2012-003
Sep
12
comment CRIME - How to beat the BEAST successor?
@CodesInChaos that's my guess too. The PoC was created in a few hours, just to check if the idea is sound.
Sep
12
awarded  Nice Answer
Sep
11
revised CRIME - How to beat the BEAST successor?
upgraded the algorithm
Sep
11
answered CRIME - How to beat the BEAST successor?
Aug
20
awarded  Caucus
Jun
25
awarded  Enlightened
Jun
25
awarded  Nice Answer
Jun
19
comment Is it safe to use leakedin.org?
@JeremyThompson the pass->hash calculation was done client side, in Javascript. Then the server checked the submitted hash.
Jun
19
comment Why doesn't the same origin policy block get requests that contain arguments?
Minor correction: SOP prevents scripts from reading content from a location that the script is running at (i.e. the address of the web page that loads the script).
Jun
8
awarded  Constituent