thespanner.co.uk
RPO
http://www.thespanner.co.uk/2014/03/21/rpo
Javascript blog with messed up syntax inside. Friday, 21 March 2014. Https:/ hackvertor.co.uk/public. Link href=styles.css rel=stylesheet type=text/css /. The link element above references style.css using a relative URL, depending where in the sites directory structure you are it will load the style sheet based on that. For example if you were in a directory called xyz then the style sheet would be loaded from xyz/style.css . I noticed something interesting with relative styles, manipulating the path of ...
giungato.it
ITSecurity - MioWiki
http://www.giungato.it/index.php/ITSecurity
IT security and networking sites. Other open source tools. 1 CISSP - Certified Information Services Security Professional. 2 OSSTMM - OPSA. 2 The Hacker's RFC. 3 Cyber Security Awareness Month 2008 - Summary and Links. 5 Security RFP cheat sheet. 0 IT Security tools. 1 Helix - a live Linux distribution oriented to Computer Forensics. 6 OpenVAS - a Nessus fork. 10 Darik's Boot And Nuke - Hard drive disk wipe. 12 UCSniff VoIP sniffer. 14 The Metasploit Framework. 15 Tor - The Onion Router. My library/La mi...
thespanner.co.uk
mXSS
http://www.thespanner.co.uk/2014/05/06/mxss
Javascript blog with messed up syntax inside. Tuesday, 6 May 2014. Mutation XSS was coined by me and Mario Heiderich to describe an XSS vector that is mutated from a safe state into an unsafe unfiltered state. The most common form of mXSS is from incorrect reads of innerHTML. A good example of mXSS was discovered by Mario where the listing element mutated its contents to execute XSS. Listing <img src=1 onerror=alert(1)> /listing. Listing id=x <img src=1 onerror=alert(1)> /listing. If you try the above ve...
blog.ciomarket.com.br
Blog CIO Market » Aplicativos para Empresas » Dicas para Aumentar a Segurança no seu WordPress
http://blog.ciomarket.com.br/2013/11/dicas-para-aumentar-a-seguranca-no-seu-wordpress
You need to sign in to vote for a post. You need to sign in to see this post. Dicas para Aumentar a Segurança no seu WordPress. Os desenvolvedores do WordPress levam a segurança muito a sério, mas como em qualquer outro sistema, existem potenciais problemas de segurança que podem surgir se algumas precauções básicas de segurança não forem tomadas. Este artigo irá listar algumas formas comuns de vulnerabilidades, e as providências que você pode tomar para manter sua instalação do WordPress segura. Sempre ...
thespanner.co.uk
HTML scriptless attacks
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks
Javascript blog with messed up syntax inside. Wednesday, 21 December 2011. Following up on @lcamtuf’s. Post about a “post xss” world. I thought I’d chip in with some vectors he missed. The textarea consumption technique he mentioned isn’t new and wasn’t invented by “Eric Y. Chen, Sergey Gorbaty, Astha Singhal, and Colin Jackson.” it was openly discussed on sla.ckers for many years (as usual) but anyway lets discuss vectors. Button as a scriptless vector. Option as a scriptless vector. Another interesting...
thespanner.co.uk
MentalJS bypasses
http://www.thespanner.co.uk/2014/06/24/mentaljs-bypasses
Javascript blog with messed up syntax inside. Tuesday, 24 June 2014. I managed to find time to fix a couple of MentalJS bypasses by LeverOne and Soroush Dalili (@irsdl). LeverOne’s vector was outstanding since it bypassed the parsing itself which is no easy task. The vector was as follows:. I/'/ alert(location);0)break/ '). For (var i$i$; / '/ alert(location);0)break/ '). For (var i$;i$ / '/ alert(location);0)break/ '). The entry ' MentalJS bypasses. Feed Both comments and pings are currently closed.
thespanner.co.uk
XSS Auditor bypass
http://www.thespanner.co.uk/2015/02/10/xss-auditor-bypass
Javascript blog with messed up syntax inside. Tuesday, 10 February 2015. Script x = "MY INJECTION" /script. As every XSS hacker knows you can use a “ /script ” block to escape out of the script block and inject a HTML XSS vector. So I broke out of the script block and used the trailing quote to form my vector. Like so:. Script script alert(1) ". You could of course use a standard. But what if quotes are filtered? X = " /script svg script alert(1) "";. The entry ' XSS Auditor bypass. Comments are closed :(.
thespanner.co.uk
2015 June
http://www.thespanner.co.uk/2015/06
Javascript blog with messed up syntax inside. Archives for the Month of June, 2015. New IE mutation vector. Wednesday, 17 June 2015. I was messing around with a filter that didn’t correctly filter attribute names and allowed a blank one which enabled me to bypass it. I thought maybe IE had similar issues when rewriting innerHTML. Yes it does of course The filter bypass worked like this: img = script alert(1) /script The filter incorrectly assumed it was still inside […].
blog.fedecarg.com
Security | Federico Cargnelutti
https://blog.fedecarg.com/category/security
Simple is better than complex. Complex is better than complicated. Check whether your web server is correctly configured. December 11, 2011. Reported a record number of 1.5 million websites defacements. 1 million of those websites where running Apache. You can check whether your web server is correctly configured by using Nikto. A great open source vulnerability scanners that is able to scan for quite a large number of web server vulnerabilities. From their site:. Http:/ www.cirt.net/nikto2. June 22, 2009.