481 reputation
38
bio website
location
age
visits member for 4 years, 5 months
seen May 19 at 7:47

python, web security, fluxfingers, mozilla.


Mar
24
comment Secure a string in PHP
What you want may be an HMAC with a timestamp?
Mar
2
comment Preventing XXE Injection
@wireghoul While this is a perfectly fine answer, the idea of StackExchange is to provide concise & complete answers: The etiquette suggests, that a definitive answer is within your post. Use links just for reference and source attribution. Anyway, here's an upvote. :)
Mar
2
comment Do WebGoat style XSS attacks still work?
I'd argue that this simple XSS case is still a prevalent issue. The XSS protections are just a safety-belt, not a real security control – says also a Google Security Engineer.
Feb
27
comment What is Net-Worm.PHP.Mongiko trying to do?
Thanks, I updated my answer. Feel free to edit right away, in the future!
Feb
26
revised What is Net-Worm.PHP.Mongiko trying to do?
added 164 characters in body
Feb
25
comment What is Net-Worm.PHP.Mongiko trying to do?
For the aspiring reverse engineers: A suspicious removal tool (that is likely malware) can be found on hXXp://rkcheck.org/index.html (this link is intentionally broken. Do not install their software.)
Feb
25
answered What is Net-Worm.PHP.Mongiko trying to do?
Feb
20
comment Is it secure to have source code for website public?
Hint: Some companies pays you money if you find security vulnerabilities in their software. For Mozilla, this includes websites and services. Even they make their source code public on GitHub! See github.com/mozilla ;)
Nov
1
answered CSP Reports: Ignoring Client Malware
Sep
24
awarded  Autobiographer
Sep
8
comment How to stop other websites from sending cross domain AJAX requests?
A canonical resource about this is OWASP's wiki page about CORS: owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
Mar
21
awarded  Yearling
Mar
21
answered Secure a string in PHP
Mar
21
comment Is a web application firewall necessary if the application is secure?
I'd like to add that "secure" may be easily contested. It might make sense to get the WAF to protect against generic attacks that are hard to defend against on the application layer (e.g., unwanted spiders)
Jan
10
answered Regarding Cross-Site Scripting attacks
Jan
10
answered Anomaly detection in HTTP REFERER
Jan
10
answered Getting detailed information about an infected website
Dec
15
comment XSS when <, > and " are escaped
I fully agree. Do you have any weird findings with regard to comments though?
Dec
11
awarded  Excavator
Dec
11
revised New XSS cheatsheet?
changed URL to current domain name