951 reputation
49
bio website erlend.oftedal.no/blog
location
age
visits member for 3 years, 5 months
seen 2 days ago

Sep
26
comment Flash ignores Content-Type header, allowing XSS?
Seems to me flash will only execute given the correct content-type these days (the frame with "Not Found" ran the flash) research.insecurelabs.org/flash
Sep
26
comment Flash ignores Content-Type header, allowing XSS?
Nope, hence the use of the word "might".
Jun
12
comment Why is the Samy Worm considered XSS?
It is in a sense cross site. The script came from Samy, not myspace.
Apr
1
comment bypass a regex filtration to perform an xss attack
If var is user controlled, that line allows arbitrary script injection. Why would you want to load a script specified by the user?
Jan
1
comment How can this xss challenge be solved?
As the author behind the challenge, here are the intended solutions: research.insecurelabs.org/xssmas/solutions.html
Oct
6
comment How does Amazon bill me without the CVC / CVV / CVV2?
@GdD If you read the PCI DSS requirements it clearly states you are not allowed to store CVC/CVV/CVV2 codes. See page 8 pcisecuritystandards.org/documents/pci_dss_v2.pdf
Sep
1
comment Current best practices to prevent persistent XSS attacks
The OWASP XSS Prevention cheat sheet and OWASP Abridged XSS prevention cheat sheet are probably worth mentioning: owasp.org/index.php/… owasp.org/index.php/Abridged_XSS_Prevention_Cheat_Sheet
Nov
17
comment Server wide javascript injection
Sounds to me like the php interpreter has been modified. Maybe reinstall php, but make a copy of the php binary and send it to virustotal.com first.
Sep
17
comment C# Encrypting string in DES 3 CBC mode
That's why a good encryption algorithms like AES takes an IV (initialization vector). The IV has many similarities with the salt when hashing passwords. It makes sure that even though you encrypt the same text, the cipher text becomes different (as long as you use a different IV of course)
Apr
27
comment How do you make sure a pdf is deleted after being viewed in the browser?
Oh, sorry. My question is, is there anything I can do from the server side (headers etc.) to tell the browser/plugin to delete the pdf when the user navigates away from the pdf or closes the pdf reader?