432 reputation
38
bio website
location
age
visits member for 3 years, 11 months
seen Nov 1 at 19:08

python, web security, fluxfingers, mozilla.


Nov
1
answered CSP Reports: Ignoring Client Malware
Sep
24
awarded  Autobiographer
Sep
8
comment How to stop other website to send cross domain ajax requests?
A canonical resource about this is OWASP's wiki page about CORS: owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
Mar
21
awarded  Yearling
Mar
21
answered Secure a string in PHP
Mar
21
comment Is a web application firewall necessary if the application is secure?
I'd like to add that "secure" may be easily contested. It might make sense to get the WAF to protect against generic attacks that are hard to defend against on the application layer (e.g., unwanted spiders)
Jan
10
answered Regarding Cross-Site Scripting attacks
Jan
10
answered Anomaly detection in HTTP REFERER
Jan
10
answered Getting detailed information about an infected website
Dec
15
comment XSS when <, > and " are escaped
I fully agree. Do you have any weird findings with regard to comments though?
Dec
11
awarded  Excavator
Dec
11
revised New XSS cheatsheet?
changed URL to current domain name
Dec
11
suggested approved edit on New XSS cheatsheet?
Dec
11
comment XSS when <, > and " are escaped
+1 (While you are right, I do not see where an escaped > would allow getting out of an HTML comment.)
Jul
18
suggested rejected edit on New XSS cheatsheet?
Nov
27
awarded  Good Answer
Oct
5
comment Are there valid reasons for spoofing an address?
If I'm not mistaken, listening for and responding to Anycast addresses might be considered spoofing as it appears that an otherwise unique address is present on two sides of a router
Sep
20
revised What “hacking” competitions/challenges exist?
this makes more sense, I suppose :)
Jul
6
comment ASLR in Ubuntu 11.10
You are completely correct. I should have mentioned the most common forms of ASLR bypasses. Your remark about 64 bit is also important. +1.
Jun
26
answered ASLR in Ubuntu 11.10