120 reputation
7
bio website
location
age
visits member for 2 years
seen Apr 15 at 20:38

He is Me and I am Yu


Oct
7
awarded  Popular Question
Oct
4
awarded  Benefactor
Oct
4
accepted OAuth2 Cross Site Request Forgery, and state parameter
Oct
2
comment OAuth2 Cross Site Request Forgery, and state parameter
Thanks. I've done such XSRF (CSRF) attacks (e.g. I sent a link to my friend that made him delete a post on his forum), and I imagine an attack where someone gives you a login URL to a site, where you login as him (victim logs in on attacker's account). It's quite easy to protect against such attack (store state in session), but aren't there more complex hacking techniques than that?
Sep
27
awarded  Promoter
Sep
14
revised OAuth2 Cross Site Request Forgery, and state parameter
updated link to the ietf draft to last version
Sep
14
asked OAuth2 Cross Site Request Forgery, and state parameter
Apr
30
awarded  Supporter
Apr
30
comment Injecting ampersand to the url
With this repeated keys i was meaning a specific situation when I already set all keys that the API reads, and the API could just check if keys aren't repeated. But indeed, it looks like I can just inject everything in one key, and then put %23 (#) on end of it. It will make everything next to parse not as keys. In some situations that would bypass the multikey checking protection, and in PHP it would always made the injected params treated as most (only) important. But my current point is, how the API can protect a developer, and looks like there's no general solution.
Apr
29
comment Injecting ampersand to the url
I wrote that the API server could check if a key is repeated, but now I think, could the hacker inject such characters, to make real ampersand become part of the previous value, and so, making the whole key-value pair 'swallowed' by previous value?
Apr
29
awarded  Scholar
Apr
29
accepted Injecting ampersand to the url
Apr
29
comment Injecting ampersand to the url
I can't believe it was so easy. It was probably too hot yesterday, that I didn't achieve it myself, I tried escaping the ampersand, just not with %26. I guess again, when I already knew something is possible, got it easily... Accepted! Thank you, good sir!
Apr
29
comment Injecting ampersand to the url
Thanks for this, I'm reading right now. As for defending, in this case it's pretty easy, as the parameter values consists only of letters and digits, but to protect other developers I think the service ('external API' in example) provider should check if some keys are repeated, and if they're different, it could just return "success:false", am I right here?
Apr
28
awarded  Student
Apr
28
awarded  Editor
Apr
28
revised Injecting ampersand to the url
just line breaks.
Apr
28
asked Injecting ampersand to the url