Reputation
35,375
Next tag badge:
91/100 score
20/20 answers
Badges
5 58 137
Impact
~2.2m people reached

Nov
3
awarded  csrf
Oct
9
comment Anti-CSRF mechanism with referer header
@pllee the PHP snip does not call exit() if the http_referer is absent. Although the referer cannot be changed, it is trivial to omit using a meta referer policy.
Oct
9
revised Anti-CSRF mechanism with referer header
added 59 characters in body
Oct
3
revised External cross domain include script
added 100 characters in body
Oct
3
comment External cross domain include script
@jcalfee314 unfortunately some assessments are conducted analysts who are blindly reporting BURP scanner findings XD. Context is important, and CDNs are fundamental requirement for scalable webapps. CDNs aren't perfect, and i recently hacked a major Akamai product...
Oct
1
awarded  Revival
Sep
26
awarded  Popular Question
Sep
22
comment Why no support for TCP Sockets in JavaScript
Consider researching the same-origin policy. Voting to close.
Sep
21
comment Security of faxes vs emails
Every facsimile machine needs to die in a fire. One big joyus fire, so that humanity can move on.
Sep
17
awarded  Enlightened
Sep
17
awarded  Nice Answer
Sep
17
awarded  Nice Answer
Sep
7
comment Is it possible to Exploit this Line Feed?
Could you provide a link to explain %E5%98%8D%E5%98%8A?
Sep
7
comment Is it possible to Exploit this Line Feed?
An attacker shouldn't need two content-types to exploit this issue. In fact, this may confuse the browser. Controlling the header and the beginning of the HTML should be sufficient to control the content of the entire page. I have no idea what micro is referring to about "%E5%98%8A%E5%98%8D", that must be chinese (literally).
Sep
7
comment Is it possible to Exploit this Line Feed?
So what the hell is "%E5%98%8D%E5%98%8A", could you link to some background information on this extremely obscure attack string? My guess is this is some kind of advanced multi-byte injection, care to elaborate? (hackerone.com/reports/52042)
Aug
19
comment Crossdomain.xml vulnerabilities
@Michal Koczwara Without a shadow of a doubt. 100% textbook issue right here, all sources will confirm that the SOP has been intentionally disabled. It really doesn't get clearer than this.
Aug
19
answered Crossdomain.xml vulnerabilities
Aug
19
awarded  Nice Answer
Aug
16
awarded  Nice Answer
Aug
13
accepted Should we start using SHA-3?