You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
EngineeringSecurityGitHub’s CSP journeyWe shipped subresource integrity a few months back to reduce the risk of a compromised CDN serving malicious JavaScript. That is a big win, but does not address related content… We shipped subresource integrity a few months back to reduce the risk of a compromised CDN serving malicious JavaScript. That is a big win, but does not address related content inject
Published: 08 October 2019 at 13:35 UTC Updated: 09 October 2019 at 07:01 UTC Whilst I was building the XSS cheatsheet I discovered some interesting behaviour in Chrome and Safari. For certain HTML elements, if you specify their ID in the URL fragment it will scroll to the element and fire a focus event. This can be triggered cross-domain using an iframe. I thought this could be abused to create a
Published: 26 September 2019 at 15:00 UTC Updated: 04 September 2020 at 14:33 UTC PortSwigger are proud to launch our brand new XSS cheatsheet. Our objective was to build the most comprehensive bank of information on bypassing HTML filters and WAFs to achieve XSS, and to present this information in an accessible way. Each vector includes a hosted proof of concept and which browser it successfully
セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。
What is Universal Cross-site Scripting (UXSS)? Common cross-site scripting (XSS) attacks target websites or web applications that are vulnerable to XSS, because of inadequate development of client-side or server-side code. These attacks have the vulnerable web page as main prerequisite, and their effect is always revolving around the user session on the vulnerable web page itself. In other words,
When doing my usual Bug Bounty research routine, I found an interesting behavior that occurred on a popular website, let’s say censored.com. Depending on whether the user was authorized to display the website two completely different pages were being shown. One, with content-type:text/html;charset=utf-8 HTTP header, and the second, without Content-Type header at all, which in that case becomes tex
New XS-Leak techniques reveal fresh ways to expose user information ‘This should be in the OWASP Top 10 in 2025’ The deanonymization capabilities of cross-site leak (XS-Leak) attacks once again came to the fore this week, as security researchers published details of two new methods that can be used to expose user information. XS-Leak refers to a family of browser side-channel techniques that can b
Mike West, July 2019 TL;DR: Let's break CSP in half and throw away some options while we're at it. Content Security Policy is a thing. We've been iterating on it for years and years now, and it shows. The backwards compatibility constraints are increasingly contorted, we've moved right past scope creep into scope kudzu, and the implementation status between browsers is inconsistent at best. I thin
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く