Skip to main content
joe's user avatar
joe's user avatar
joe's user avatar
joe
  • Member for 7 years, 5 months
  • Last seen more than 3 years ago
14 votes

Does a CSRF cookie need to be HttpOnly?

5 votes

Bypass Asp.Net 4.6 "A potentially dangerous Request.QueryString value was detected from the client"

3 votes

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind)

3 votes

Block spam that looks like it is coming from actual humans, and not bots?

2 votes

How can "unvalidated redirects and forwards" be exploited?

2 votes

Twitter allows the password to be resolved from a stolen cookie. Is that a problem?

2 votes

Is HSTS Header Helpful For Mobile Applications?

2 votes

How to verify CORS policy implementation?

2 votes

Continuous SQL injection testing

2 votes

Allowing the execution of arbitrary code in python

1 vote
Accepted

Are JSON web services vulnerable to CORF attacks?

1 vote

Is it possible to breach prepared statement and stored procedures with unsafe sql query string

1 vote

PCI-DSS : Sending antivirus logs from private infrastructure to public cloud?

1 vote

How would you explain CSRF token to a newbie? How is it safer than cookie based approach?

1 vote

How to update table with sqlmap and without stacked queries?

1 vote

How should connection between a hosted server and a database be secured?

1 vote

Is it okay if apps in pre-production environment can be accessed without VPN?

1 vote

Why Oracle says following deserialization vulnerabilities are related to HTTP protocol?

1 vote

How to handle OAuth2 refresh_token for sessionless login?

0 votes

WAF - How to tell what automated tool is causing alerts

0 votes

Cookie hijacking bypassing authentication?

0 votes

Casting return from ClassUtil.newInstance

0 votes

PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops

0 votes

How can I find webpages with webapps using a specific framework?

0 votes

How does pornhub infer gender?

0 votes

Authorization / Access control in a client-side-encryption environment

0 votes

Is a user being able to view their own UID a security risk?