homakov

77 ms·

811.
by homakov 13y ago
They launched bounty, this was the motivation to check things i always wanted to check. It took me about 4-5 hours, most of that time I was watching TV shows.
812.
by homakov 13y ago
Security screencasts with Russian accent? HA HA.
813.
by homakov 13y ago
///host.com bug is not well documented. It's "0day" for most of websites.
814.
by homakov 13y ago
0. I spent less than an hour last year because there was no proper motivation.
815.
by homakov 13y ago
It's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.
816.
by homakov 13y ago
95% of my security research is not paid. I fix gems, libraries, websites etc. Donated money go right there, through beers and coffee I need.
817.
by homakov 13y ago
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
818.
by homakov 13y ago
"nothing" never happened IRL. I either work extra for free trying to find more, and punch myself until I find something.
819.
by homakov 13y ago
Exactly. + if github would really ask me for consulting I'd consider working for free, just for a testimonial.
820.
by homakov 13y ago
OK means it's OK but could be better :P
821.
by homakov 13y ago
>relatively new way to distribute malware >JavaScript code stored in an obfuscated PNG they reinvent the wheel agian?
822.
by homakov 13y ago
bought membership. Hella fast! Thanks
823.
by homakov 13y ago
No word about security hah. I'd expect it <h1>! Will "NSA"/etc know what torrents I downloaded?
824.
by homakov 13y ago
1. how to know who's talking? 2. when you add video?
825.
by homakov 13y ago
Github also has slow patch cycle. Enterprise edition
826.
by homakov 13y ago
I dont need anything. I was saying now you need some good 0days because it is hard to find silly xss on github these days
827.
by homakov 13y ago
Now there is nothing to hax.
828.
Turbo Cross-Origin-Resource-Sharing(soarez.github.io)
1 points by homakov 13y ago|0 comments
829.
by homakov 13y ago
All you need is to check references & testimonials of a company you want to hire. Why pay for some random crap from no-name "craporation"?
830.
by homakov 13y ago
"We got local file inclusion but cannot read /etc/passwd. No idea what went wrong..."
831.
Speed up your CORS API(homakov.blogspot.com)
3 points by homakov 13y ago|0 comments
832.
Turbo API: How to use CORS without Preflights(homakov.blogspot.com)
5 points by homakov 13y ago|0 comments
833.
by homakov 13y ago
I am really not into fulltime job. Doing consulting suits me much more
834.
by homakov 13y ago
Yes, it is = user interaction
835.
by homakov 13y ago
Yeah, it's breached on the website but it's fb who's in charge.
836.
by homakov 13y ago
issue 1: when victims visits attacker's page, I relogin them in my facebook and load /fb/connect URL, which boils down to attaching my facebook to victim's website account = hijacking.
837.
by homakov 13y ago
I edited the post because i changed my mind. I was simply disappointed with my results and wanted more. Later I realized - "more" will come later, just keep working! No dark side :)
838.
by homakov 13y ago
Not to the button but to create a dummy form. Simple csrf. Relogin leads to identity fixation
839.
Two "WontFix" vulnerabilities in Facebook Connect(homakov.blogspot.com)
188 points by homakov 13y ago|35 comments
840.
Two severe "WontFix" vulnerabilities in Facebook Connect(homakov.blogspot.com)
11 points by homakov 13y ago|0 comments

More ›