Aug
2
comment FireFox's restore previous session restores logins authenticated by server's sessions
I think it is good that we can restore session cookies, users should have the choice to restore the website session. I would not want be forced to log in again when I close the browser or the browser crashed...
Jul
20
comment How to prevent XSS from url
This does not prevent an XSS attack like javascript:alert(1) in href or src HTML attribute, like mentioned by @oriadam. Here is a solution for this, by checking the protocol with the parse_url PHP function: stackoverflow.com/questions/19047119/…
Jun
7
comment Cracking a JWT signature
Did you update your script to make it more efficient? By the way, it is possible to crack the key of an RS256-signed JWT? (I noticed you only mentioned HS256 on your GitHub repository)
May
9
comment How limit request rate of sqlmap?
@hmrojas.p +1 this can still be interesting to know as a comment even if not in the scope of the question. It is related since it could help bypass a WAF.
2018
Dec
1
comment Comparison Between AppArmor and Selinux
When reading that SELinux is "incredibly complex" and "very difficult to independently verify", it reminds me that SELinux has been created by the NSA so this complexity was maybe created on purpose to silently introduce backdoors like we saw with Snowden leaks.
Nov
8
comment Horizontal vs vertical authentication bypass
I also read about lateral authentication bypass (used together with vertical authentication bypass), I guess it is a synonym for horizontal authentication bypass.
2017
Dec
17
comment What is the difference between MITMproxy and SSLsplit?
And what is the exact difference between sslplit and sslsniff? cc @DanielRoethlisberger
Jul
9
comment How does a client's web-browser know if a website is HTTPS only?
HSTS Preload List Submission: hstspreload.org (some websites are hardcoded in web browsers as being HTTPS only)
2014
Jan
17
comment What are the privacy pros and cons of using a public DNS server vs. your own?
Sure Google lies. Facebook lied too blogs.lawyers.com/2012/08/… I'm sure NSA loves DNS requests ;)
Jan
16
awarded  Supporter
2013
Dec
11
awarded  Autobiographer