Rook

21,084 reputation

11969

bio	website	stachliu.com
	location
	age
visits	member for	2 years, 4 months
	seen	4 hours ago
stats	profile views	1,117

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.

	21,084 reputation	bio	website	stachliu.com	visits	member for	2 years, 4 months
11969 badges		location			seen	4 hours ago

summary answers questions tags badges favorites bounties reputation activity

1,732 Actions

suggestions reviews revisions comments badges posts accepts all

May 15	comment	Are CSRF Attacks Really Blind @Gumbo Yes... and a CSRF exploit will not use an XHR for this reason. Was that your point?
May 15	awarded	javascript
May 14	revised	Are CSRF Attacks Really Blind edited body
May 14	answered	Are CSRF Attacks Really Blind
May 13	revised	How to hide victim pop-up in clickjacking? added 120 characters in body
May 13	revised	How to hide victim pop-up in clickjacking? added 98 characters in body
May 13	answered	How to hide victim pop-up in clickjacking?
May 13	comment	Blocking network access to host(s) at the kernel level in Linux? @Animism any module can be built into a compiled kernel, and root can change or modify what kernel they are using and reboot. root is god.
May 13	revised	CSRF protection with custom headers (and without validating token) added 371 characters in body
May 13	comment	CSRF protection with custom headers (and without validating token) @Simon Lieschke So a few months ago, navigateToURL() didn't require a crossdomain.xml policy, it looks like this vulnerability has been patched and my exploit has been fixed. Oah well. It also looks like the CORS rules have changed to have a "preflight" options request for requests with special headers with JS. This type of attack is more difficult to carry out. You might want to post a question about this to all of security.se
May 13	comment	CSRF protection with custom headers (and without validating token) @Simon Lieschke something might have changed with the latest version of flash... let me check it out.
May 10	answered	Security of web services (REST & SOAP)
May 10	revised	Pseudo Random Generator is not initialized from the (entropy pool)? added 1 characters in body
May 10	comment	CSRF protection with custom headers (and without validating token) @Simon Lieschke No this does not come into play, because a cross-domain policy is not loaded by this ActionScript client. This ability to control headers is not an ability granted by the "cross-domain policy", it is just native behavior.
May 10	comment	Is it possible for a hacker to download a php file without executing it first? @dshaw I think this was covered more clearly in my post. In general directory traversal in all functions except include/require lead to source code disclosure.
May 9	comment	How can I find subdomains of a site? @D3C4FF hell yeah, I'm glad it did the trick ;)
May 9	comment	DNS Amplification DDOS attack @Luc it strikes me as a drop in the bucket. Even setting a ratelimit of 5 responses per second is enough if you rotate your requests between 27 million servers.... Face it, the internet as we know it is too naive.
May 8	comment	Does escaping quotes protect me from SQL injection? Remove the preg_replace it only makes this system less secure because it undermines your ability to escape control characters. You even accidentally modified this function to produce single quotes `'`... You are attempting to make a change to security function used by everyone and you are breaking it entirely. Why not rely upon a proven security system?
May 8	comment	Does escaping quotes protect me from SQL injection? @Nisan Actually getting out of the quotes is the easy part, because you are giving the attacker a backslash which is as dangerous as a quote mark (after-all that is the point of escaping!). You are also giving the attacker `()` because there is a bug in your regex. Exploiting sql injection without spaces is nothing new. The problem I am having is actually terminating the query. Security experts use parametrized queries, which avoids this problem.
May 8	comment	Does escaping quotes protect me from SQL injection? Actually this is much worse, the preg_replace() makes the mysql_escape_string() vulnerable to sql injection! It allows the attacker to have a backslash at the end the string! Every use of this function is vulnerable to SQLi.