4 ms·
Three vulnerabilities every web application developer should know about
- sh1mmer 18y agoYou should also look at the XSS cheat sheet http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html
- pkrumins 18y agoThanks for this link! I added it to the article!
- technoguyrob 18y agoIf you want to get more hands-on familiar with these, I used to be an administrator at hackthissite.org. It's a site that has hacking "missions" which let you try to get in the shoes of the cracker. It was very helpful for me in learning about things like SQL injections and XSS. http://hackthissite.org http://hackthissite.org
- tptacek 18y agoThis post is really epsilon from linkjacking.
- pkrumins 18y agoWhat do you mean?
- tptacek 18y ago99.999% of the content of this submission is in a link from the article submitted itself, and the article itself has only the barest familiarity with the topic ("XSSI but no XSS?"). I'm glad it was submitted, but we should vote and comment on the Google TechTalk itself. I just submitted it.
- pkrumins 18y agoI am glad to hear your opinion. Not everyone has an hour to watch the lecture. I have been blogging about video lectures in this style for a while now, and I have received quite a few emails thanking me for providing sum-ups of the videos. I was also very surprised at the time of submission that he talked about XSSI but did not cover XSS! Only later did I add a paragraph about XSS! Sorry about that.
- tptacek 18y agoOk, guy with the linkjacked summary of a Google TechTalk? XSSI is XSS.
- pkrumins 18y agoOh! I was talking about static XSS then! The example Neil gave in his talk was about dynamic XSS. I thought XSSI meant that and "XSS" meant this - http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cgisecurity.com/articles/xss-faq.shtml
- rw 18y ago"is a PhD from Stanford" vs. "has a PhD from Stanford" connotations...
- pkrumins 18y agoThanks! I changed it to "has a PhD from Stanford".
- beaudeal 18y agoi enjoyed the talk - thanks for the post!