Friday, December 27, 2013

Rapportive XSSes Gmail or have yourself a merry little botnet...

›
tldr:  Learn how to code audit Handlebars applications. Xss in extension = fun times. Mosquito gets new features. It's that magic...
5 comments:
Monday, December 16, 2013

Breaking Google AppEngine webapp2 applications with a single hash

›
What's this, you think? 07667c4d55d8d81a0f0ac47b2edba75cb948d3a2$sha1$1FsWaTxdaa5i It's easy to tell that this is a salted p...
Tuesday, October 15, 2013

Exploiting EasyXDM part 2: & considered harmful

›
tldr: URL parsing is hard, always encode stuff and Safari has some interesting properties... This is a second post describing easyXDM v...
Monday, September 23, 2013

Exploiting EasyXDM part 1: Not the usual Flash XSS

›
tldr: You're using easyXDM? Upgrade NOW. Otherwise - read up on exploiting difficult Flash vulnerabilities in practice. Secure cross-...
Thursday, July 11, 2013

Jealous of PRISM? Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites!

›
tldr: Insecure browser addons may leak all your encrypted SSL traffic, exploits included So, Snowden let the cat out of the bag. They...
24 comments:
Friday, January 11, 2013

Abusing MySQL string arithmetic for tiny SQL injections

›
Today I've found a small nifty trick that may become helpful when exploiting SQL injection vulnerabilities for MySQL. Namely, you can ...
6 comments:
Friday, December 7, 2012

On handling your pets and a CSRF protection that wasn't

›
Security is hard . While security-related issues are fun and challenging subject for many - fun enough for them to take part in various CTF...
19 comments: