29,504 reputation
234105
bio website bishopfox.com
location
age
visits member for 3 years, 9 months
seen 4 mins ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


6h
comment Requirment for encryption algorithem to be secure/safe
Hacking is a lot of fun, but security classes tend to ask ridicules questions, and students dump these crap questions on security.se
6h
comment Requirment for encryption algorithem to be secure/safe
@Bob Brown looks like dry homework to me.
6h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox The only way I can get cookies to be sent this way is in chrome with --disable-web-security which is inline with standard: w3.org/TR/cors. Are you sure you don't have this option set?
9h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox This is what i see imgur.com/6jMkeYl , and because of this observation I don't think either of us will be writing CSRF exploits using this technique.
9h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox Are we talking about the same PoC? (jsfiddle.net/wyvLbt7n/2)
9h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox It is no accident that XHR is useless in the exploitation of CSRF. If you see a browser violate the XHR/CORS standards, please report it to the project maintainer so that they fix this high risk vulnerability.
9h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox The PoC you provided does not transmit a cookie because it is missing the withCredentials directive. Try sending a request to a site with an established session, like https://www.google.com and viewing the network traffic.
9h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
-1 I don't believe the OPs question anything to do with a strange, non-standards complaint browser, and as far as I can tell this answer nothing to do with exploitation of CSRF. I would take away the -1, but I can't.
11h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox Yeah, your exampled showed me that although the POST data was there, the cookies weren't sent. I forgot about that detail, thanks for info.
11h
revised How is the same origin policy causing my PoC to fail when I don't need to read return data?
added 19 characters in body
11h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I updated my post to contain more detailed information on why XHRs are simply not useful in exploiting CSRF.
11h
revised How is the same origin policy causing my PoC to fail when I don't need to read return data?
added 347 characters in body
11h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox, aah you are right I was partially mistaken. An XHR needs to have the withCredentials attribute, you need the cookie in order to ride on the session with CSRF. Which is why XHRs are never used in CSRF exploits.
11h
answered How is the same origin policy causing my PoC to fail when I don't need to read return data?
12h
answered Security concerns with iframes
12h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I'm sorry, but it just doesn't work that way. Prove me wrong, show me a CSRF exploit that you have written that uses an XHR. (This is an impossible task for a modern browser.) If the target has CORS enabled, the the web app has bigger problems than CSRF.
12h
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I should reiterate, XHR can never be used in a CSRF attack because the CORS pre-flight request prevents this attack.
1d
comment Socket.IO Client Security
@mtdevens I think that this: websocket.org/aboutwebsocket.html disagrees... I am pretty sure you need CORS to have a cross-origin WebSocket. Do you have any references?
1d
comment Facebook full IP log
@ekaj Female computer? Now we are talking!
1d
revised Socket.IO Client Security
added 397 characters in body