meta user
network profile
| bio | website | erlend.oftedal.no/blog |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 6 months |
| seen | 20 hours ago | |
| stats | profile views | 25 |
|
Apr 1 |
comment |
bypass a regex filtration to perform an xss attack If var is user controlled, that line allows arbitrary script injection. Why would you want to load a script specified by the user? |
|
Mar 13 |
answered | Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib? |
|
Jan 11 |
awarded | Good Answer |
|
Jan 1 |
comment |
How can this xss challenge be solved? As the author behind the challenge, here are the intended solutions: research.insecurelabs.org/xssmas/solutions.html |
|
Dec 22 |
awarded | Nice Answer |
|
Dec 22 |
awarded | Yearling |
|
Dec 21 |
answered | How can I explain SQL injection without technical jargon? |
|
Nov 29 |
answered | I need explanation on how serious these vulnerabilities are? |
|
Oct 6 |
comment |
How does Amazon bill me wihout the CVC / CVV / CVV2? @GdD If you read the PCI DSS requirements it clearly states you are not allowed to store CVC/CVV/CVV2 codes. See page 8 pcisecuritystandards.org/documents/pci_dss_v2.pdf |
|
Sep 21 |
answered | How can I prevent reflected XSS in my JSON web services? |
|
Sep 1 |
comment |
Current best practices to prevent persistent XSS attacks The OWASP XSS Prevention cheat sheet and OWASP Abridged XSS prevention cheat sheet are probably worth mentioning: owasp.org/index.php/… owasp.org/index.php/Abridged_XSS_Prevention_Cheat_Sheet |
|
Aug 28 |
answered | What is the danger of Reflected Cross Site Scripting? |
|
Jun 19 |
answered | Why doesn't the same origin policy block get requests what contain arguments? |
|
Mar 6 |
answered | For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be? |
|
Dec 23 |
answered | Is strip_tags() horribly unsafe? |
|
Nov 17 |
comment |
Server wide javascript injection Sounds to me like the php interpreter has been modified. Maybe reinstall php, but make a copy of the php binary and send it to virustotal.com first. |
|
Nov 11 |
awarded | Yearling |
|
Sep 17 |
comment |
C# Encrypting string in DES 3 CBC mode That's why a good encryption algorithms like AES takes an IV (initialization vector). The IV has many similarities with the salt when hashing passwords. It makes sure that even though you encrypt the same text, the cipher text becomes different (as long as you use a different IV of course) |
|
Sep 17 |
answered | Is it possible to see if a script on a website steals session cookies? |
|
May 25 |
awarded | Nice Question |
