homakov

94 ms·

961.
by homakov 13y ago
1) only to make sure we are on the same page. Now I see - we have different understanding of "session". >Not all sites use sessions (some for performance reasons, others for privacy reasons); what kind of site doesn't use
962.
by homakov 13y ago
>Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK
963.
by homakov 13y ago
and yes, they clearly state it was made as a solution to cookie forcing: >Your site is on a subdomain with other sites that are not under your control, so cookies could come from anywhere. it should be default, for sure.
964.
by homakov 13y ago
since it's attack on secrets then we don't even consider blogs and read only media as targets :)
965.
by homakov 13y ago
sorry, I think in terms of Rails, in rails a session is a _site_sess cookie... i am not sure how it works in Django but what here is a post about it http://homakov.blogspot.com/2013/06/cookie-forcing-protectio...
966.
by homakov 13y ago
1) session and logged in/out user are two different things. Session is the way you store information about current user, no matter he is anonymouse or logged in. 2) I checked again for instance https://bitbucket.org/ -
967.
by homakov 13y ago
> * Be served from a server that uses HTTP-level compression this is the only must-have. Last 2 exist almost in every website (everyone needs a CSRF token, everyone reflects something somewhere)
968.
by homakov 13y ago
1) open https://www.djangoproject.com/ 2) find /contact/, /email/, user group
969.
by homakov 13y ago
P.S. i am not into django, but if you have a clue how to contact authors... please tell them to put CSRF token into session cookie. It must be fixed in the first place, BREACH is 100 times harder and longer, while cookie forcing is complete
970.
by homakov 13y ago
Rails is not vulnerable to cookie forcing btw. But your authentication can be (Devise bug http://blog.plataformatec.com.br/2013/08/csrf-token-fixation... )
971.
by homakov 13y ago
im a rabbit
972.
by homakov 13y ago
i wouldn't call it a proper defense, rather a work around. besides CSRF tokens there are lots of secret strings, and it's not website's problem to avoid wiretapping
973.
by homakov 13y ago
XOR-based masking, yes, but I thought we were talking about currently common systems. Until BREACH nobody masked tokens, did they?
974.
by homakov 13y ago
Not everyone supports non-JS user but yes, it's a minus.
975.
by homakov 13y ago
obviously second version (when CSRF token is stolen) is not possible to mitigate.
976.
by homakov 13y ago
wow, so wrong. where did you find that?
977.
by homakov 13y ago
https://gist.github.com/homakov/6147227 thoughts?
978.
by homakov 13y ago
Django is vulnerable to cookie forcing. BREACH is not needed, CSRF token can be replaced with active MITM
979.
by homakov 13y ago
Why do they need talents? they need marketing strategy and profitable products, and a bunch of middle level engineer to implement it. after all, talents can simply quit their jobs after acquiring
980.
by homakov 13y ago
This hack, while nice, is still just a work around. I highly recommend that if you can, in as many places as possible use YAML instead of JSON. Rails RCE, sup
981.
Google Translate hack explained(homakov.blogspot.com.es)
3 points by homakov 13y ago|0 comments
982.
by homakov 13y ago
:) it's pleasant to explain hacks you discover. actually PoC is fixed - http://homakov.blogspot.com.es/2013/07/googleusercontentcom-...
983.
by homakov 13y ago
working PoC now! http://homakov.blogspot.com.es/2013/07/googleusercontentcom-...
984.
by homakov 13y ago
I have no life.
985.
by homakov 13y ago
I think glebm implies the same: "iframe code can access `frames[0].document` cross domain" means through translate.google.com and "modifies target page on another domain" modifies page with same domain but rendered on
986.
by homakov 13y ago
Safe mode disallows scripts. It should be disabled. Not sure about google plus, it works for me in incognito.
987.
by homakov 13y ago
This is unrelated exception. Looks like problem guys described below (not logged in google). I can't reproduce, but it is not browser bug, just matter of having google account
988.
by homakov 13y ago
Part with yourname is other_origin. I change content of GUC Page 2 using GUC Page 1 through other_origin (translate.google.com). No XSS or cookies. Just standards :D
989.
by homakov 13y ago
i am js jedi, but don't spend much time on PoCs.
990.
by homakov 13y ago
Login stuff? When I/my friends run it in incognito there is nothing but that link. There is some weird token in URL, but it seems to be valid for everyone. I made it 30px to hide "tooltips" on hover

More ›