CGISecurity Logo

Topics

Tags

  • Security Industry Plagiarism: Finding 3 examples in 5 minutes with Google

    Posted by Robert A on

    in
    , , , , , , , ,
    | |

    UPDATE: One of the authors has posted two responses including an apology (accepted). I was taught in grade school that if you plan on writing something, never plagiarize. If you want to republish portions of existing content ensure you properly quote/reference them, and never represent this content as your own original work. Unfortunately it seems…

  • Tracking and understanding security related defects: Useful data points for shaping your SDLC program

    Posted by Robert A on

    in
    , , ,
    | |

    In addition to CGISecurity, I also run a website called QASEC.com where I post SDLC related content. I've just published a lightweight article discussing tips and tricks for tracking software level vulnerabilities in larger organizations. Abstract:"If you work in infosec for a large organization it can be difficult to easily track the state of every…

  • Improving ASP.NET Security with Visual Studio 2010 Code Analysis

    Posted by Robert A on

    in
    , , , , ,
    | |

    Sacha Faust has published a great article on some of the security checking functionality in Visual Studio. From the article "Anyone doing ASP.NET development probably admits, openly or not, to introducing or stumbling upon a security issue at some point during their career. Developers are often pressured to deliver code as quickly as possible, and…

  • Twitter XSS worm

    Posted by Robert A on

    in
    , , ,
    | |

    An XSS worm has hit twitter this morning and appears to have affected hundreds of thousands of users. Sophos has a good technical writeup at http://www.sophos.com/blogs/gc/g/2010/09/21/twitter-onmouseover-security-flaw-widely-exploited/ ARSTechnica has some coverage about Magnus Holm, the author of the worm. http://arstechnica.com/security/news/2010/09/twitter-worms-spread-quickly-thanks-to-blatant-security-flaw.ars I'll update this post once a more accurate count of affected users is published.

  • CGISecurity Turns 10!: Summary of the more interesting site posts throughout the years

    Posted by Robert A on

    in
    , , , , , , ,
    | |

    To commemorate this site turning 10 I've created a list of my top 10 thought provoking/innovate posts that people who haven't been following this site may be unaware of.   The Cross-site Scripting FAQ (2001) In 2001 someone informed me of this new threat involving the injection of HTML/Javascript into a site's response (XSS). At…

  • CGISecurity.com Turns 10!: A short appsec history of the last decade

    Posted by Robert A on

    in
    , , , , , , , , , ,
    | |

    Ten years ago today I started cgisecurity.com to fill a void in the application security space. At the time no other dedicated site existed, neither OWASP nor WASC had been created, and the www-mobile list was effectively the only place to discuss web related vulns and attacks . When I first started this site I…

  • New Site Addressing Python Security

    Posted by Robert A on

    in
    , , , , ,
    | |

    For you python developers out there, Craig Younkins sent the following to The Web Security Mailing List (which I moderate) this morning. "I'd like to invite you to a new community – http://www.pythonsecurity.org/ –which is now the central hub for security in Python. We're writing articleson security topics and how they pertain to Python, analyzing…

  • Apache Compromised Again

    Posted by Robert A on

    in
    , ,
    | |

    It appears someone used a combination of XSS on an Apache domain, a url shortener, and an issue tracking system to ultimately lead to rooting of 2 core Apache machines used to host bugzilla, and the main shell server. This is a great breakdown of a real world incident that people rarely publicly speak about,…

  • Larry Suto Web Application Security Scanner Comparison Report Inaccurate Vendors Say

    Posted by Robert A on

    in
    , , , ,
    | |

    Larry Suto published a report comparing the various commercial web application security scanners. As you'd expect the vendors are likely to respond about how inaccurate the report is, however in this case both HP and Acunetix argued valid points. From Acunetix "They were not found because Larry didn’t authenticated our scanner (didn’t provided any credentials). No…

  • Nikto version 2.1.1 released

    Posted by Robert A on

    in
    , , , ,
    | |

    Sullo has sent the following announcement to the full disclosure mailing list indicating a new release of Nikto. "I'm happy to announce the immediate availability of Nikto 2.1.1! Nikto is an open source web server scanner which performscomprehensive tests against web servers for multiple items, includingover 6100 potentially dangerous files/CGIs, checks for outdatedversions of over…

  • WASC Threat Classification to OWASP Top Ten RC1 Mapping

    Posted by Robert A on

    in
    , , , ,
    | |

    Jeremiah Grossman and Bil Corry have created a nice visual mapping between the OWASP Top Ten and the WASC Threat Classification v2. More Information: http://jeremiahgrossman.blogspot.com/2010/01/wasc-threat-classification-to-owasp-top.html

  • Announcement: WASC Threat Classification v2 is Out!

    Posted by Robert A on

    in
    , , , , , , , , , ,
    | |

    I am very pleased to announce that the WASC Threat Classification v2 is finally out the door. This project has by far been one of the most challenging, intellectually stimulating projects I've had the chance to work on. I have included the official announcement below. "The Web Application Security Consortium (WASC) is pleased to announce…

  • Experimenting With WASC Threat Classification Views: Vulnerability Root Cause Mapping

    Posted by Robert A on

    in
    , , ,
    | |

    I currently lead the WASC Threat Classification Project and we're expecting to publish our latest version next month. One of the biggest changes between the TCv2 and TCv1 is that we're doing away with single ways to represent the data. In the TCv1 we had a single tree structure to convey appsec concepts. After months…

  • Announcing the Web Application Security Scanner Evaluation Criteria v1

    Posted by Robert A on

    in
    , , , , , ,
    | |

    “The Web Application Security Consortium is pleased to announce the release of version 1 of the Web Application Security Scanner Evaluation Criteria (WASSEC).  The goal of the WASSEC project is to create a vendor-neutral document to help guide information security professionals during web application scanner evaluations.  The document provides a comprehensive list of features that…

  • Reddit XSS worm spreads

    Posted by Robert A on

    in
    , , , ,
    | |

    UPDATE: Reddit has posted a blog entry at http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html addressing this. "Popular social news website Reddit has stopped the spread of a cross-site scripting (XSS) worm that hit the site on Monday. The XSS worm spread via comments on the site, originally from the account of a user called xssfinder. Reddit failed to filter out…

  • Chrome adds defence for cross-site scripting attacks, already busted

    Posted by Robert A on

    in
    , , ,
    | |

    "The 4.0.207.0 release uses a reflective XSS filter that checks each script before it executes to check if the script appears in the request that generated the page. Should it find a match, the script will be blocked. According to Chromium developer Adam Barth, the developers plan to post an academic paper that will describe…

  • Cross-protocol XSS with non-standard service ports

    Posted by Robert A on

    in
    ,
    | |

    i8jesus has posted an entry on smuggling other protocol commands (such as ftp) in HTML forms, as well as edge case situations where running a tcp service (in this case ftp on a non standard port) can result in more XSS abuse cases. While not likely still worth a read. "Most people have thought about…

  • WASC Distributed Open Proxy Honeypot Update – XSS in User-Agent Field

    Posted by Robert A on

    in
    , ,
    | |

    "In case you missed it, the WASC Distributed Open Proxy Honeypot Project launched Phase III at the end of July. We have a few sensors online and as we start gathering data, we are starting our analysis. Our goal is to be able to release "events of interest" to the community to try and raise…

  • Bypassing OWASP ESAPI XSS Protection inside Javascript

    Posted by Robert A on

    in
    ,
    | |

    "Everyone knows the invaluable XSS cheat sheet maintained by "RSnake". It isall about breaking things and features all the scenarios that can result inXSS. To complement his efforts, there is an excellent XSS prevention cheatsheet created by "Jeff Williams" (Founder and CEO, Aspect Security). As faras I have seen, this wiki page provides the most…

  • Threat Classification v2 and the need for change

    Posted by Robert A on

    in
    , , ,
    | |

    As I recently posted the WASC Threat Classification v2 is currently in a public working state and there's been a buzz on the mailing lists about it compared to other related projects. Vishal Garg posed a question I was expecting for awhile which is why does the TCv2 look so much different than TCv1? I've…

  • WASC Threat Classification 2.0 Sneak Peek

    Posted by Robert A on

    in
    , , , , , , ,
    | |

    Here is a sneak peek at the WASC Threat Classification v2.0. We’ve been working on this for more than a year and it’s been a very challenging, educational experience to say the least. Sections that are gray are currently in peer review and are not completed. Mission statement “The Threat Classification v2.0 outlines the attacks…

  • When XSS can cost you $10,000

    Posted by Robert A on

    in
    , , ,
    | |

    "Did you hear the one about the hacker-free e-mail service that was so confident about its enhanced security measure that it offered up $10,000 to anyone who could hack into it? It got hacked. Here’s the part that’s really crazy, though. There was initially some question as to whether or not the team of three…

  • McAfee site vulnerable to xss

    Posted by Robert A on

    in
    , , ,
    | |

    "McAfee, widely recognized as one of the leading providers of online security software for both home and business, appears to be struggling to secure its own Web sites, which at the time of writing this post, allow anyone with enough tech savvy to covertly do whatever they want on, and with, the site. During tests…

  • Google Chrome Universal XSS Vulnerability

    Posted by Robert A on

    in
    , , ,
    | |

    "During unrelated research, I came across a number of security issues that reside in various parts of Google's web browser – Google Chrome. These issues pose a major threat to any user that browses a maliciously crafted page using Internet Explorer and has Google Chrome installed alongside. Using a vulnerability in the ChromeHTML URL handler,…

  • Firefox 3.0.9 Released to Fix Multiple Security Flaws

    Posted by Robert A on

    in
    , , ,
    | |

    MFSA 2009-22 Firefox allows Refresh header to redirect to javascript: URIs MFSA 2009-21 POST data sent to wrong site when saving web page with embedded frame MFSA 2009-20 Malicious search plugins can inject code into arbitrary sites MFSA 2009-19 Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString MFSA 2009-18 XSS hazard using third-party stylesheets and XBL bindings…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.