3 ms·
The thing that I find difficult with OWASP: there doesn't always seem to be comprehensive examples provided for what these attack surfaces could be used for. Th
by bluepnume 7y ago
The thing that I find difficult with OWASP: there doesn't always seem to be comprehensive examples provided for what these attack surfaces could be used for. That makes it difficult to both understand the impact of a particular issue, and test for it.
As an example: https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#always-return-json-with-an-object-on-the-outside https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security...
I'm fascinated to know how this could actually be exploited. But there's no hint or reference to that. It's just "don't do this".
- brennebeck 7y agoHere you go: https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/ https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-j...
- Boulth 7y agoThe biggest pain point in these security guidelines is context. For example this Array override issue has been fixed in major browsers 11 years ago [0]. Unless someone codes for IE6 I'd consider this not a real problem. [0]: https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/
- bashwizard 7y agoIf you're really interested in to actually know how and why something could be exploited I'd recommend reading a lot of reports from HackerOne, Bugcrowd etc.