1,482 reputation
21640
bio website
location Minsk, Belarus
age 23
visits member for 2 years, 10 months
seen Aug 4 at 17:51

Sep
4
comment DOM XSS : Need Help
All downloads for DOM Snitch are marked as deprecated at its site. Can you recommend other methods for finding DOM-based XSS?
Jun
1
comment Is client side encryption really better than server side?
There is such thing as TLS
Jan
2
comment Security comparsion of 3DES and AES
AES and other NIST standards aren't very good in software
Jan
2
comment Security comparsion of 3DES and AES
It should be 2^64
Jan
2
comment How can I embed iframe securely without restricting its functionality?
_blank links don't work as expected without allow-top-navigation
Dec
23
comment Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength?
Possible duplicate: Does having a minimum number of digits improve password security?
Dec
22
comment How can I embed iframe securely without restricting its functionality?
There is also problem with sites like stackoverflow.com that have custom clickjacking protection and I think it can be solved in similar way
Dec
22
comment How can I embed iframe securely without restricting its functionality?
@RoryMcCune I can poll framed sites from time to time and check if it has such header or have user's browser send feedback if it sees that it's not possible to show site in iframe.
Dec
21
comment How can I embed iframe securely without restricting its functionality?
@Laurence to display other site inside mine
Nov
2
comment Drupal filters XSS with regexes. What could bypass it?
See Is Drupal's filter_xss enough for filtering HTML?
Nov
1
comment How to escape user input in a value of javascript object?
Regarding 2: Firefox doesn't seem to treat ] as the end of value. Haven't checked in other browsers
Nov
1
comment How to escape user input in a value of javascript object?
Why 1 is necessary? Will quoting make it less vulnerable? What is the reason to quote keys besides complying to standard?
Nov
1
comment How to escape user input in a value of javascript object?
Which of these are necessary? Of course 4 and 5 are necessary but what about others?
Nov
1
comment Is it necessary to scan users' file uploads by antivirus?
Some well known parser libraries like nokogiri have very low number of vulnerabilities ever found so I'm not sure defense in depth is necessary
Oct
25
comment Why not buy cheap SSL certificates?
Possible duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find?
Oct
3
comment Is it possible to verify identity of site that sent request to you?
Code for creating widget may be placed to several places. The easiest attack may be to place this widget to localhost and then reload it many times. But I don't want to pay for such requests as it's not even rendered on site where it should be. There is no problem for me if widget isn't placed at traget site (No views => No pay). There is a problem if it will be placed somewhere else except target site.
Oct
3
comment Is it possible to verify identity of site that sent request to you?
Yes, I pay per view
Oct
3
comment Is it possible to verify identity of site that sent request to you?
It won't prevent from embedding widget to another sites. As I said, I pay to site for each widget show so I want to actually verify that this show was at valid site where widget was intended to be.
Sep
26
comment Insecure versions of crypt hashes
Read this, please: php.net/security/crypt_blowfish.php. $2a$ is secure in PHP>=5.3.7
Sep
21
comment Efficient way for finding XSS vulnerabilities?
Thank you for answer! Using what tools this manual activity can/should be automated? I mean generating input strings, inserting them into request parameters, looking for them in responses etc. Do you do all those things manually with each request parameter?