Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
7
Newest
 Scholar
Impact
~546 people reached

  • 0 posts edited
  • 0 helpful flags
  • 7 votes cast
Dec
3
awarded  Scholar
Dec
3
accepted Javascript injection in email address as username?
Dec
3
revised Javascript injection in email address as username?
added 47 characters in body
Dec
1
comment Javascript injection in email address as username?
can you combine the quoted with the unquoted? wondering if you can write something like xenoterracide+"<script>alert(1)</script>"@gmail.com
Dec
1
revised Javascript injection in email address as username?
added 33 characters in body
Dec
1
comment Javascript injection in email address as username?
it's not really a problem of inputs but outputs, I've come to an enlightenment, sanitizing inputs isn't really the goal. You want to sanitize outputs, SQL injection is about sanitizing what is sent to the SQL server. Javascript Injection is about sanitizing what is sent to the browser. I want to craft a malicious input to see if any one of 50 outputs does not sanitize it properly. (no I'm not saying don't validate your inputs)
Dec
1
comment Javascript injection in email address as username?
@schroeder right, I'm just trying to figure out if there's a way to craft an email address that would send, but could be used for an exploit if rendered. Just pen testing our app, about to log some other vulnerabilities I've found.
Dec
1
asked Javascript injection in email address as username?
Oct
19
comment How can I write a good corporate password policy?
though not part of my question... there is 0 windows involved at our company.
Oct
19
comment How can I write a good corporate password policy?
@Zymus yeah the users don't care, but policies tend to be put in place because they don't care. Users wouldn't encrypt their drives and have passwords on their laptops if we didn't tell them. In fact I recall hearing a complaint about having to encrypt. Policies are not written for the people who will just do the right thing, but the people who won't. Sadly policies can be used to fire people who are doing the correct thing, but are not following the policy, because the policy is not right, because the writer didn't understand nuance, or didn't think of an exception, etc.
Oct
19
asked How can I write a good corporate password policy?
Oct
8
awarded  Teacher
Oct
5
comment Unique assignment of permissions to objects seems to also require the role?
@jhash I thought "role explosion" was when I had to create more roles than what seems reasonable (like role type per org in multitenancy). So far I'm not seeing that. I'm just looking to see if there are better solutions than what I've come up with, and advantages/disadvantages to the approaches.
Oct
4
awarded  Commentator
Oct
4
comment Unique assignment of permissions to objects seems to also require the role?
@jhash groups and roles are not synonyms. Unix file security without extensions is a DAC model.
Oct
4
revised Unique assignment of permissions to objects seems to also require the role?
edited tags
Oct
4
comment Using “Literal” Passwords
Hmm... I think I read recently that you could brute force 10 characters in a lot less than that, at random. 12 was the new recommended. Something about "Thanks Amazon" and other cheap computing clusters.
Oct
4
awarded  Editor
Oct
4
revised Using “Literal” Passwords
added 330 characters in body
Oct
4
comment Using “Literal” Passwords
@PythonMaster would you clarify whether "I don't have one" is literal or an example (maybe I should just try authing to your account ;), nah)