User Interface Security Directives for Content Security Policy
UI Security and the Visibility API defines both a declarative and imperative means for resources displayed in an embedded context to protect themselves against having their content obscured, moved, or otherwise displayed in a misleading manner. This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publi
Scriptless Attacks – Stealing the Pie Without Touching the Sill
Scriptless Attacks – Stealing the Pie Without Touching the Sill Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, Jörg Schwenk Horst Görtz Institute for IT-Security Ruhr-University Bochum, Germany {firstname.lastname}@rub.de ABSTRACT Due to their high practical impact, Cross-Site Scripting (XSS) attacks have attracted a lot of attention from the security community members. In the sa
Scriptless Attacks - Stealing the Pie without touching the Sill
Scriptless Attacks - Stealing the Pie without touching the Sill - The document discusses scriptless attacks that can bypass traditional XSS defenses like NoScript and XSS filters by leveraging new HTML5 and CSS features. - It presents several proof-of-concept attacks including using CSS to steal passwords, using SVG fonts to brute force CSRF tokens, and using custom fonts to leak sensitive informa
情報セキュリティ大学院大学 大久保研究室
エラーが発生しました。 ページが存在しません。URLの打ち間違いもしくは削除された可能性があります。
HTML5 Security Resources Repository
PostgreSQL vs MongoDB Research Papers on HTML5 Security [Back to Home] A Security Analysis of Next Generation Web Standards The Emperor�s New APIs: On the (In)Secure Usage of New Client-side Primitives HTML5 Overview: A Look at HTML5 Attack Scenarios HTML5 Web Security Attacking�with�HTML5 Abusing HTML 5 Structured Client-side Storage Blog posts on HTML5 Security [Back to Home] How a Platform Usin
W3 conf hill-html5-security-realities
1. HTML5 Security Realities Brad Hill, PayPal bhill@paypal-inc.com @hillbrad W3Conf: Practical standards for web professionals 21 -22 February 2013 San Francisco 2. “The reason that the Web browser is the principal entry point for malware is the number of choices that a browser offers up to whomever is at the other end. Evolving technologies like HTML5 promise to make this significantly worse.” –
XSS and CSRF with HTML5
This document discusses cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks in HTML5. It begins with an overview of the evolution of HTML and the expansion of the browser attack surface with new technologies. It then covers specific XSS vectors using new HTML5 features like media tags, autofocus attributes, and forms. The document also examines how CSRF can be conducted using
DNS Prefetching
Problem DNS resolution time can lead to a significant amount of user perceived latency. The time that DNS resolution takes is highly variable. Latency delays range from around 1ms (locally cached results) to commonly reported times of several seconds. Solution DNS prefetching is an attempt to resolve domain names before a user tries to follow a link. This is done using the computer's normal DNS re
Play safely in sandboxed IFrames | Articles | web.dev
Play safely in sandboxed IFrames Stay organized with collections Save and categorize content based on your preferences. Constructing a rich experience on today's web almost unavoidably involves embedding components and content over which you have no real control. Third-party widgets can drive engagement and play a critical role in the overall user experience, and user-generated content is sometime
Using the HTML5 Fullscreen API for Phishing Attacks » Feross.org
This blog post contains JavaScript and other dynamic content that will not display correctly in most RSS readers. I recommend reading this post directly in your web browser. Quick! Click this link to Bank Of America. There’s nothing fishy about it at all! I promise! Go ahead – hover your mouse over the link to see where it goes. You’ll find that it’s a completely normal link to https://www.bankofa
HTML5_Web_Security_v1.0</title> <meta name="Subject" content=""> <meta name="Keywords" content=""> <meta name="Author" content="Michael Schmidt"> <meta name="Creator" content="Microsoft Office Word- Word-Addin 6.61.5623"> <meta name="Producer" content="eD
Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona T +41 55 214 41 60 F +41 55 214 41 61 team@csnc.ch www.csnc.ch HTML5 web security December 6th, 2011 Document Name: HTML5_Web_Security_v1.0.docx Version: v1.0 Author: Reviewer: Michael Schmidt, Compass Security AG Thomas Röthlisberger, Compass Security AG Date of Delivery: December 6th, 2011 Classification: Article HTML5 web security –
[PDF] Attacking with HTML5 (slides)
ATTACK & DEFENSE labs Attacking with HTML5 Lavakumar Kuppan ATTACK & DEFENSE labs Who am I ? • Web Security Researcher • ½ of Attack and Defense Labs, www.andlabs.org • Penetration Tester @ really big bank • Author of Imposter & Shell of the Future • Likes HTML5 @lavakumark Disclaimer: Views expressed in this talk are my own and does not necessarily reflect those of my employer Black Hat Abu Dhabi
Filejacking: How to make a file server from your browser (with HTML5 of course)
on security, malware, cryptography, pentesting, javascript, php and whatnots Back in the days of browser wars, there was a joke: Internet Explorer is the only web browser that makes Internet browse your computer. Through various security flaws, IE was exploitable and allowed for remote code execution that could e.g. steal your sensitive files. But now the times are different. It's not that easy to
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
[pdf]Cross-origin pixel stealing: Timing attacks using CSS filters
Html5: Something wicked this way comes (Hack in Paris)
Amazon.com: HTML5 Hacking and JavaScript Security: Attacks and Defenses: Shah, Shreeraj: Books
https://html5sec.org/webkit/test
Kevin Johnson & Tom Eston -- Desktop Betrayal: Exploiting Clients through the Features They Demand
[PDF]A Security Analysis of Next Generation Web Standards
[PDF] Attacking with HTML5 (whitepaper)