CGISecurity Logo

Topics

Tags

  • CGISecurity Article: The Cross-Site Request Forgery FAQ

    Posted by Robert A on

    in
    , , , ,
    | |

    The Cross-site Request Forgery FAQ has been released to address some of the common questions and misconceptions regarding this commonly misunderstood web flaw. This paper serves as a living document for Cross-Site Request Forgery issues and will be updated as new information is discovered. If you have any suggestions or comments please contact us. UPDATE:…

  • Accessing Java Clients with the BeanShell

    Posted by Robert A on

    in
    | |

    "Assessing the security of Java applications, and particularly client- server applications, can be a tedious process of modifying the code, compiling, deploying, testing and repeat. This becomes even more difficult when the source code to the application is not available. What security testers require is an easy means of interacting with the internals of a…

  • Ajax Security Basics Article

    Posted by Robert A on

    in
    , ,
    | |

    "Ajax is considered the next step in a progression towards the trumpeted, "Web 2.0." The purpose of this article is to introduce some of the security implications with modern Ajax web technologies. Though Ajax applications can be more difficult to test, security professionals already have most of relevant approaches and tools needed. The authors will…

  • Ajax Storage: A Look at Flash Cookies and Internet Explorer Persistance

    Posted by Robert A on

    in
    ,
    | |

    An Anonymous Employee Writes " Foundstone has an interesting write up on their site about Flash shared objects and other AJAX caching developments from a security angle. The Dojo JavaScript Framework already includes code to make use of this. These "cookies " can save larger amounts of data, can be accessed across domains, across web…

  • HttpSecureCookie, A Way to Encrypt Cookies with ASP.NET 2.0

    Posted by Robert A on

    in
    ,
    | |

    "I really have some good laughs when I tamper with cookies on my machine and watch the results when it is submitted back to the site. On the other hand, I don’t want any one to do the same to the cookies that I make! Cookies, most of the times, shouldn’t be in plain text,…

  • Burton: Put Web Services Security on front burner

    Posted by Robert A on

    in
    | |

    "Now that the WS-Security spec is "ready for prime time" and many security products are supporting it, organizations should start to develop a Web services security strategy, according to Anne Thomas Manes, a vice president and research director at Burton Group in Midvale, Utah. However, in her recent report, Web Services Security: A Plethora of…

  • Uninformed Online Zine #3 Released

    Posted by Robert A on

    in
    , , ,
    | |

    A online zine called 'uninformed' has just released issue #3. I gotta say it's worth checking out. Below is the list of the table of contents. * Bypassing PatchGuard on Windows x64 * Windows Kernel-mode Payload Fundamentals * Analyzing Common Binary Parser Mistakes * Attacking NTLM with Precomputed Hashtables * Linux Improvised Userland Scheduler Virus…

  • PAPER: Preventing Http Session Fixation Attacks

    Posted by Robert A on

    in
    , , , ,
    | |

    Zinho Writes "I've published the final research about Http Session Fixation covering the most known attacks and how to prevent them. The paper is written from a web developer point of view and shows various techniques to be safe from fixation and hijacking." Paper Link: Preventing Http Session Fixation Attacks (Paper)

  • Top 7 PHP Security Blunders

    Posted by Robert A on

    in
    ,
    | |

    Sitepoint has published an article covering the 7 most common vulnerability types applied to the PHP language as well as configuration options to futher lock down your environment. While I disagree with the structure/actual 7 the article is good and worth checking out. If you're lazy and just want the seven here it is. (I'm…

  • New Approach to .NET obfuscation

    Posted by Robert A on

    in
    ,
    | |

    I found an interesting article on slashdot talking about a new technology that will further lockdown .NET applications. From this initial article this looks like a promising new technology. "One area of research is called "Program State Code Protection,” or PSCP, which means changing the code AS IT RUNS to make it harder for a…

  • Two new Blind SQL Injection papers released

    Posted by Robert A on

    in
    , , ,
    | |

    This week two new papers on blind sql injection have been released. The first paper was released by Webcohort goes into detail on how to detect blind sql injection, and how to carry out an attack. The paper released by Spidynamic's "SPI Labs" covers similar information, but also contains example 'fixes' for ASP.NET, and JSP…

  • Microsoft released Ebook on web security

    Posted by Robert A on

    in
    , ,
    | |

    Microsoft has released a massive 919 page ebook covering everything from how to lock down your web server, web services, web applications, and web application servers. This book is worth a read and I highly recommend it. Improving Web Application Security: Threats and Countermeasures, June 2003 (PDF) (6.7 Meg)

  • Article #2: “The Cross Site Scripting Faq”

    Posted by Robert A on

    in
    , , ,
    | |

    Currently small informational tidbits about Cross SiteScripting holes exist but none really explain them to an average person or administrator. This FAQ was written to provide a better understanding of this emerging threat, and to give guidance on detection and prevention. This article also covers practicle examples of cookietheft, and also provides tools for public…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.