991 reputation
49
bio website erlend.oftedal.no/blog
location
age
visits member for 3 years, 8 months
seen Jun 1 at 8:31

Feb
26
answered Is SSL a mitigating factor for HTTPonly not set on cookies?
Nov
11
awarded  Yearling
Nov
5
answered Tracing security policy permissions in JavaScript
Sep
26
awarded  Commentator
Sep
26
comment Flash ignores Content-Type header, allowing XSS?
Seems to me flash will only execute given the correct content-type these days (the frame with "Not Found" ran the flash) research.insecurelabs.org/flash
Sep
26
comment Flash ignores Content-Type header, allowing XSS?
Nope, hence the use of the word "might".
Sep
25
answered Flash ignores Content-Type header, allowing XSS?
Jun
12
comment Why is the Samy Worm considered XSS?
It is in a sense cross site. The script came from Samy, not myspace.
Apr
1
comment bypass a regex filtration to perform an xss attack
If var is user controlled, that line allows arbitrary script injection. Why would you want to load a script specified by the user?
Mar
13
answered Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
Jan
11
awarded  Good Answer
Jan
1
comment How can this xss challenge be solved?
As the author behind the challenge, here are the intended solutions: research.insecurelabs.org/xssmas/solutions.html
Dec
22
awarded  Nice Answer
Dec
22
awarded  Yearling
Dec
21
answered How can I explain SQL injection without technical jargon?
Nov
29
answered I need explanation on how serious these vulnerabilities are?
Oct
6
comment How does Amazon bill me without the CVC / CVV / CVV2?
@GdD If you read the PCI DSS requirements it clearly states you are not allowed to store CVC/CVV/CVV2 codes. See page 8 pcisecuritystandards.org/documents/pci_dss_v2.pdf
Sep
21
answered How can I prevent reflected XSS in my JSON web services?
Sep
1
comment Current best practices to prevent persistent XSS attacks
The OWASP XSS Prevention cheat sheet and OWASP Abridged XSS prevention cheat sheet are probably worth mentioning: owasp.org/index.php/… owasp.org/index.php/Abridged_XSS_Prevention_Cheat_Sheet
Aug
28
answered What is the danger of Reflected Cross Site Scripting?