Clickjacking Details ha.ckers.org web applicati...
Today is the day we can finally start talking about clickjacking. This is just meant to be a quick post that you can use as a reference sheet. It is not a thorough advisory of every site/vendor/plugin that is vulnerable - there are far too many to count. Jeremiah and I got the final word today that it was fine to start talking about this due to the click jacking PoC against Flash that was released
IE6.0 Protocol Guessing ha.ckers.org web application security lab
SirDarckCat sent an interesting email this morning about IE6.0. Apparently it attempts to guess what you mean in certain circumstances allowing for rigid anti-XSS filters to fail when looking for precise terms like javascript: and vbscript: even after attempting to de-obfuscate. Rather than attempt to explain, take a look at this snippet from his email: There are some characteristics in internet e
Book review: Professional Pen Testing for Web Applications ha.ckers.org web application security lab
ha.ckers.org web application security lab - Archive » XSS Book Preview
Well, we are finally done with the XSS book (XSS Attacks - Cross Site Scripting Attacks Exploits and Defense). It’s off at the presses, and should be on the shelves in a few week’s time. We were authorized to throw up a sample chapter and the table of contents from the book for anyone who would like to read it. You can download a zipped up version of Chapter 5 and the table of contents. Since it w
Yahoo Mail XSS 0-Day ha.ckers.org web application security lab
Hong has been coming up with some really interesting research, including something he found where you can use HTML entities inside event handlers to jump outside of certain types of encapsulation to use a cross site scripting attack. He even has a demo page set up here. Nasty, but how common is this? Well using event handlers (onmouseover, onload, onunload, etc…) are pretty common, but how many pe
Charset Vulnerability Map ha.ckers.org web application security lab
I’ve been meaning to do this for a lonnnng time, but I finally got around to building a map of vulnerable charsets (that I know of). This is nowhere near complete, and lots of this has yet to be tested but what I have mapped out I do know to have at least one vulnerability (variable width encoding, or some other selected encoding attack against normal anti-XSS filters). Click here for the list. I
More CSS Obfuscation ha.ckers.org web application security lab
Over the last few weeks I’ve had a number of exchanges with Yosuke Hasegawa and Cheng Peng Su about various encoding issues within IE7.0 and IE6.0. Unfortunately I am fresh out of IE6.0 installs, so I have nowhere to test some of these theories. I sorta have to take it on faith that it works, or maybe someone out there can verify for me, but apparently Yosuke has found some interesting CSS obfusca
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
XSS Testing Greasemonkey Script ha.ckers.org web application security lab
Whiteacid built a pretty remarkable XSS Greasemonkey assistant script. It’s got a few kinks left to work out as we’ve been discussing but on the whole this is feeling like a possible right approach to by-hand penetration testing for XSS vulnerability assessment. I still think something like this should be built into burp suite but Whiteacid’s approach is pretty slick. After installation and going
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Jikto Leaked ha.ckers.org web application security lab
Google Hires RSnake ha.ckers.org web application security lab
DNS Pinning Doesn’t Exist in Flash ha.ckers.org web application security lab
Firefox HTTPOnly Implementation In JavaScript ha.ckers.org web application security lab