BgrWorker
  • Member for 6 years, 6 months
  • Last seen more than 2 years ago
Is this an attempted SQL injection?
62 votes

This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not ...

View answer
Strange Payment Gateway
20 votes

A bit more info on that obfuscated javascript: They're using packer, a quite famous javascript compression method. Here's the unpacked js (you can also unpack it yourself here: http://dean.edwards....

View answer
Is CORS helping in anyway against Cross-Site Forgery?
16 votes

You're mixing things up. CORS is not meant to protect your application from crafted http requests, it's meant to protect you from a certain kind of attacks that "steals" the user's cookies or access ...

View answer
Is there any way to protect ourselves from annoying redirects?
Accepted answer
4 votes

From the context, I understand you're referring to Chrome mobile. This version doesn't allow addons, so you can't install any ad-blocker. The first way to prevent (some) redirects is to browse in ...

View answer
Email got hijacked or hacked, where to start?
Accepted answer
2 votes

You already changed your password, so the first thing to do would be to enable Two Factor Authentication if your provider has that service (and if it doesn't, I'd highly suggest changing provider). ...

View answer
How dangerous is storing the hashed password in local storage?
1 votes

This approach is strictly less secure than storing a standard session token/cookie and sending the password in plain text. First of all, the client-hashed password works as a password replacement, so ...

View answer
Can I do an enveloping XAdES signature on binary content?
1 votes

There are three valid signature methods concerning european norms: CAdES PAdES XAdES PAdES and XAdES refer specifically to a document format, PDF and XML. PDF files signed with PAdES will remain PDF,...

View answer
Why should password authentication require sending the password?
0 votes

You have a few problems there. The server needs to have your password to validate the hash you send to it. While SSH accounts are configured locally on the system before remote access, your common ...

View answer
Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?
-1 votes

A good way to implement it is generate temporary credentials that can only upload to a specific bucket portion (the one that the user has access). Even in the event those credentials get stolen from ...

View answer