Reputation
3,266
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
12 33
Newest
 Curious
Impact
~45k people reached

Aug
29
comment 302 redirect and the body on the page (you are redirected to …)
So basically your question is if a http header redirect can be suppressed via some input to execute code following it? Clients definitely do not have to follow it, so it would be interesting to know if an attacker can force this. Either way, I would HTML encode the input when echoing it. As you describe it, you would also be open to redirect.
Aug
27
comment How dangerous is reflected request query strings?
I would assume that you probably can't inject clickable links though. If XSS is not possible, '"> are probably encoded. Phishing might still be possible, but that makes it a bit more difficult (eg "For security purposes this link is not clickable. Please copy-paste it: [link to phishing site]").
Aug
13
answered Is it worth checking the referrer?
Aug
12
comment Protection against clickjacking in Firefox without installing addons?
@user83098 Yes, JavaScript is not needed for clickjacking at all (although it's easier if JavaScript is enabled, because it eg allows an attacker to move the target with the mouse, meaning the victim may click anywhere). Of course, some web functionality is broken without JavaScript, so the attack surface for clickjacking is reduced without it. Combined attacks such as clickjacking + XSS are now also not possible. But the basic attack - getting a victim to click something they didn't mean to click - still exists.
Aug
10
comment Can I prevent timing attacks with random delays?
@IainDuncan Right, the instruction set should be as similar as possible. Eg ($user, $pw1) = dbquery(...); if(!userExists($user)) { timingSafeCheckPW($pw1, 'nothing'); exit; } else if(timingSafeCheckPW($pw1, $pw2)) { logUserIn(); } else { exit; } (of course, the actually executed code will still have different times because of branching, but that really shouldn't matter for network based attacks). In practice, I wouldn't reduce code readability to prevent an unlikely timing attack on usernames (protecting passwords is a different matter).
Aug
10
answered Can I prevent timing attacks with random delays?
Aug
10
answered Protection against clickjacking in Firefox without installing addons?
Aug
10
comment Why do people use IP address bans when IP addresses often change?
@MichealJohnson maybe they don't have a choice. Because their ISP doesn't offer dynamic IPs, because the wlan they are stealing doesn't offer it, because their roommate who is paying for internet needs a static IP, because they didn't think about it when signing their contract with their ISP, because their university doesn't offer dynamic IPs, etc. But I think that - at least for now - the second point I'm mentioning is more of a reason.
Aug
10
answered Why do people use IP address bans when IP addresses often change?
Aug
7
accepted Reflected XSS via $_FILES
Aug
5
comment How did the hacker get access to my WordPress upload folder?
In it's current form, this question really isn't answerable. If you would rephrase it as What steps can be taken to retrace a Shell Upload on a WordPress installation it might still be closed as too broad, but I could at least imagine possible answers (look at logs, look at vulnerability databases for new vulnerabilities in your plugins/themes, check the versions of your software, etc), which might be nice as a canonical answer for these types of questions, which do come up quite often.
Aug
5
reviewed Close How did the hacker get access to my WordPress upload folder?
Aug
5
reviewed Leave Open Are there technical differences which make Linux less vulnerable to virus than Windows?
Aug
5
reviewed Leave Open How to communicate how secure your system is to your employer's clients
Aug
5
awarded  Curious
Aug
4
reviewed Close Site to report password security policy issues
Aug
4
comment Site to report password security policy issues
I think in it's current form this question is off-topic (sounds too much like product recommendation). It might be valid if you rephrased it as "Is sending plaintext passwords via email a recognized security vulnerability?" (as in, it has a CWE, it's mentioned in advisories, reputable vulnerability listings such as bugtraq have it listed, there are CVEs with it, etc).
Aug
4
comment {PHP} SQL Injection
What if my password is 0mysuperawesomepassword? Suddenly, my password isn't secure at all.
Aug
4
asked Reflected XSS via $_FILES
Aug
1
reviewed Leave Open Stalking and harassment