blog.beford.org

thespanner.co.uk

RPO

http://www.thespanner.co.uk/2014/03/21/rpo

Javascript blog with messed up syntax inside. Friday, 21 March 2014. Https:/ hackvertor.co.uk/public. Link href=styles.css rel=stylesheet type=text/css /. The link element above references style.css using a relative URL, depending where in the sites directory structure you are it will load the style sheet based on that. For example if you were in a directory called xyz then the style sheet would be loaded from xyz/style.css . I noticed something interesting with relative styles, manipulating the path of ...

thespanner.co.uk

HTML scriptless attacks

http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks

Javascript blog with messed up syntax inside. Wednesday, 21 December 2011. Following up on @lcamtuf’s. Post about a “post xss” world. I thought I’d chip in with some vectors he missed. The textarea consumption technique he mentioned isn’t new and wasn’t invented by “Eric Y. Chen, Sergey Gorbaty, Astha Singhal, and Colin Jackson.” it was openly discussed on sla.ckers for many years (as usual) but anyway lets discuss vectors. Button as a scriptless vector. Option as a scriptless vector. Another interesting...

beford.org

beford.net

http://beford.org/bio

Developer, IT Security. F @ beford.net. Ability to break stuff. Java / C# / C. PHP / Javascript / CSS. Develop and mantain operative system recovery option for customers, create images, research and develop. Universidad Nacional de Colombia - Bogota, Colombia. Ingenieria de Sistemas — Current. Fernando M — f[at]beford.net.

beford.org

beford.net

http://beford.org/sec

Over the time I have discovered and reported some security issues:. Multiple flaws (SQL Injection, Remote code execution, XSS). Mozilla Firefox JAR: Redirect.

beford.org

beford.net

http://beford.org/tux

nedbatchelder.com

Ned Batchelder: The structure of .pyc files

http://nedbatchelder.com/blog/200804/the_structure_of_pyc_files.html

The structure of .pyc files. The structure of .pyc files. Wednesday 9 April 2008. I spent some time digging around in the Python code to understand how .pyc files work. It turns out they are fairly simple, then kind of complex. At the simple level, a .pyc file is a binary file containing only three things:. A four-byte magic number,. A four-byte modification timestamp, and. A marshalled code object. The magic number is nothing as cool as cafebabe. XA0; show file. XA0;    f. XA0;    magic. XA0; magic .

thespanner.co.uk

MentalJS bypasses

http://www.thespanner.co.uk/2014/06/24/mentaljs-bypasses

Javascript blog with messed up syntax inside. Tuesday, 24 June 2014. I managed to find time to fix a couple of MentalJS bypasses by LeverOne and Soroush Dalili (@irsdl). LeverOne’s vector was outstanding since it bypassed the parsing itself which is no easy task. The vector was as follows:. I/'/ alert(location);0)break/ '). For (var i$i$; / '/ alert(location);0)break/ '). For (var i$;i$ / '/ alert(location);0)break/ '). The entry ' MentalJS bypasses. Feed Both comments and pings are currently closed.

thespanner.co.uk

XSS Auditor bypass

http://www.thespanner.co.uk/2015/02/10/xss-auditor-bypass

Javascript blog with messed up syntax inside. Tuesday, 10 February 2015. Script x = "MY INJECTION" /script. As every XSS hacker knows you can use a “ /script ” block to escape out of the script block and inject a HTML XSS vector. So I broke out of the script block and used the trailing quote to form my vector. Like so:. Script script alert(1) ". You could of course use a standard. But what if quotes are filtered? X = " /script svg script alert(1) "";. The entry ' XSS Auditor bypass. Comments are closed :(.

thespanner.co.uk

2015 June

http://www.thespanner.co.uk/2015/06

Javascript blog with messed up syntax inside. Archives for the Month of June, 2015. New IE mutation vector. Wednesday, 17 June 2015. I was messing around with a filter that didn’t correctly filter attribute names and allowed a blank one which enabled me to bypass it. I thought maybe IE had similar issues when rewriting innerHTML. Yes it does of course The filter bypass worked like this: img = script alert(1) /script The filter incorrectly assumed it was still inside […].

beford.net

beford.net

http://beford.net/bio

Developer, IT Security. F @ beford.net. Ability to break stuff. Java / C# / C. PHP / Javascript / CSS. Develop and mantain operative system recovery option for customers, create images, research and develop. Universidad Nacional de Colombia - Bogota, Colombia. Ingenieria de Sistemas — Current. Fernando M — f[at]beford.net.