3,171 reputation
419
bio website
location
age
visits member for 3 years, 11 months
seen yesterday

Interested in web application security and programming languages.


Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
1
revised Does an established ssl connection mean a line is really secure
added 246 characters in body
Sep
1
answered Does an established ssl connection mean a line is really secure
Aug
28
comment How can document.referrer be used for XSS?
@MichaelBlake, sorry, I misunderstood which part was the payload and which was the container.
Aug
27
comment How can document.referrer be used for XSS?
assigning to innerHTML doesn't run <script>s. Try <img onerror="..." src=bogus> instead.
Aug
27
answered Does CSRF prevention also prevent reflected XSS attack?
Aug
25
comment CSRF vulnerability in CGI/shell script web interface of hardware
@SilverlightFox, Does the safe method convention in RFC 7231#4.2.1 sound like the right term to you?
Aug
25
revised CSRF vulnerability in CGI/shell script web interface of hardware
edited body
Aug
25
comment CSRF vulnerability in CGI/shell script web interface of hardware
@SilverlightFox, Good point. I suppose the HTTP DELETE method is idempotent if it succeeds silently when its target address does not refer to anything, and PUT is idempotent since it overwrites, but allowing DELETE and PUT cross-origin while disallowing POST would surprise many. Will edit.
Aug
19
answered What's the inverse of sandbox security pattern?
Aug
12
revised Can installing Snort make me vulnerable?
formatting
Aug
8
comment How the address bar manage the XSS?
"1"? Not "test"?
Aug
8
comment How the address bar manage the XSS?
What do you mean by "work"? Does an alert pop up? Should it?
Aug
7
comment User Enumeration Vulnerability while creating Google account
@Engineer, as schroeder points out, email accounts are not private, so there's little gain, and early captchas might lead to fewer legitimate account creations because users might be more willing to do a captcha after they're invested in a name they've chosen.
Aug
6
comment Is there a need to have XSS filters when I'm saving data as XML?
@vikkyhacks, UTF-7 attacks were the canonical example of encoding level attacks. Modern browsers are immune, but there might be other ways to cause the browser to see a '<' character without the XML containing a `'<`` byte. For example, if your write treats the input as ASCII, and your XML parser expects UTF-8 and treats overly-long UTF-8 sequences as text nodes and normalizes the output.
Aug
6
comment Is there a need to have XSS filters when I'm saving data as XML?
Writing and reading from a file is subject to race conditions. Does the kind of file system you're on make it impossible for get_name see the beginning of one write from write_to_xml_as and the end of another?
Aug
6
comment Is there a need to have XSS filters when I'm saving data as XML?
With what headers is the HTML served? If you don't have any <meta charset="..."> or equivalent header, then encoding-level attacks might be possible.
Aug
6
comment User Enumeration Vulnerability while creating Google account
@Engineer, If the cost of enumerating the n-th email address by this method is less than the benefit that comes from knowing the email address, then an attacker can profit from doing so. If enumerating is hard/inefficient, then there are fewer attackers who would benefit so the system is less vulnerable.
Aug
6
comment should I give the csrf token a descriptive name?
How is this name exposed to users? How long is the token good for?