Does Apple really log every app you run? A technical look – Jacopo Jannone - blog
Does Apple really log every app you run? A technical lookNovember 14, 2020 • edited November 18, 2020 Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue. Hey Apple users: If you're now
How to Protect Against Slow HTTP Attacks | Qualys Security Blog
Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests in pieces slowly, one at a time to a Web server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. When the server’s concurrent connection pool reaches its maximum, this creates a DoS. Slow HTTP attacks are easy
GitHub - brannondorsey/dns-rebind-toolkit: A front-end JavaScript toolkit for creating DNS rebinding attacks.
Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network (LAN). It can be use
About rel=noopener
What problems does it solve? 2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change. If the demo on this page no longer seems scary, congratulations — you’re using a modern browser! You’re currently viewing index.html. Imagine the following is user-generated content on your website: Click me!!1 (same-origin) Clicking the above link opens malicious
リンクのへの rel=noopener 付与による Tabnabbing 対策 | blog.jxck.io
なお IE は(security zone setting をいじらない限り)この問題が発生しないようだ。 引用元: blankshield demo | Reverse tabnabber phishing tabnabbing 上記の挙動を、フィッシング詐欺に利用できることが既に指摘されている。 この手法は Tabnabbing と呼ばれている。 Tabnabbing: A New Type of Phishing Attack Aza on Design Target="_blank" - the most underestimated vulnerability ever この攻撃方法を解説する。 攻撃の概要 https://cgm.example.com (左上) というサービスがあるとし、これは SNS やチームコラボレーション系サービスを想定する。 攻撃者は、このサービスの不
A New Type of Phishing Attack - AzarAsk
In essence, a phishing attack is a kind of hack used by cybercriminals to trick victims into performing a certain activity. These emails are frequently sent in bulk with the intention of duping unwary persons into falling into their fraud. Every day, a new type of phishing assault is launched against enterprises. Some feature the use of email and web pages, while others may entail the use of text
Things to Use Instead of JWT | Kevin Burke
You might have heard that you shouldn't be using JWT. That advice is correct - you really shouldn't use it. In general, specifications that allow the attacker to choose the algorithm for negotiation have more problems than ones that don't (see TLS). N libraries need to implement M different encryption and decryption algorithms, and an attacker only needs to find a vulnerability in one of them, or
Stop using JWT for sessions, part 2: Why your solution doesn't work - joepie91's Ramblings
Stop using JWT for sessions, part 2: Why your solution doesn't work Almost a week ago I published an article explaining why you shouldn't use JSON Web Tokens as a session mechanism. Unfortunately, it seems I've found the upper limit on article length before people stop reading - many of the commenters on Reddit and Hacker News kept suggesting the same "solutions" over and over again, completely ig
Stop using JWT for sessions - joepie91's Ramblings
Update - June 19, 2016: A lot of people have been suggesting the same "solutions" to the problems below, but none of them are practical. I've published a new post with a slightly sarcastic flowchart - please have a look at it before suggesting a solution. Unfortunately, lately I've seen more and more people recommending to use JWT (JSON Web Tokens) for managing user sessions in their web applicati
grsecurity
What are code reuse attacks? Why have they resisted defenses up to now? To explain this story fully, we need some historical context. Since the late 1990s, exploitation of memory corruption vulnerabilities had largely used what's generally called "shellcode" to achieve complete control over a compromised application. In 2000 with the release of PAGEEXEC and MPROTECT by the PaX Team, the use of she
JWT.IO
JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. JWT.IO allows you to decode, verify and generate JWT. Learn more about jwtSee jwt libraries Warning: JWTs are credentials, which can grant access to resources. Be careful where you paste them! We do not record tokens, all validation and debugging is done on the client side.
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Flask-SeaSurf — SeaSurf 1.1.1 documentation
GitHub - Yelp/detect-secrets: An enterprise friendly way of detecting and preventing secrets in code.
Analyse your HTTP response headers
Macaroons 101: Contextual Confinement | Evan Cordell
Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud
7 Best Practices for JSON Web Tokens
KickThemOut ~ Project – k4m4
Netzob: Reverse Engineering Communication Protocols
security-guide-for-developers/security-checklist.md at master · FallibleInc/security-guide-for-developers