nbpoole

45 ms·

421.
by nbpoole 16y ago
It would be interesting to analyze whether the code was actually malicious (or could be used for malicious things) or spammy but benign.
422.
by nbpoole 16y ago
Yes. I chose to demonstrate it using an XSS vulnerability because it makes for a much easier to understand PoC (you click on a link and see an alert box). ;) Had the XSS vulnerabilities failed, I would have spent more time investigating the
423.
by nbpoole 16y ago
You're talking about what's known as an open redirect. And you're correct: those can definitely be used to make a phishing attack more effective. But as I mentioned, reddit only redirects users to reddit content: you need to provide a relat
424.
by nbpoole 16y ago
Yup. That change dates back to PHP 4.4.2, which was released back in January 2006. It's listed at http://php.net/ChangeLog-4.php as "Prevent header injection by limiting each header to a single line." I'm actually curious about a recent f
425.
by nbpoole 16y ago
What Tom said. To be clear, nealpoole.com is my personal blog, not a company blog: I just happen to enjoy web application security. :)
426.
by nbpoole 16y ago
Aww, someone submitted my blog post. :)
427.
by nbpoole 16y ago
Hitting Enter in the search field on your front page sends an empty POST request to http://alpha.beepl.com:8889/ , which spits back quite a bit of (what appears to be) sensitive configuration information.
428.
by nbpoole 16y ago
A little security tip: http://thingsand.me/media/images/image_228.html Your uploader is blindly trusting the file extension for an image being uploaded. It's possible to upload valid images that contain HTML or other content within them.
429.
by nbpoole 16y ago
That isn't the goal of an XSS attack. :P http://en.wikipedia.org/wiki/Cross-site_scripting
430.
by nbpoole 16y ago
It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box. http://fluin.com/?search=Search%22%20onclick=alert%28documen... Since you're using PHP, I recommend you use a function like htmls
431.
by nbpoole 16y ago
It does. If you look closely, you'll see that HN's URL parser ignored the ] at the end of the URL. If you click on the URL and then add a ] to the end of it, your JSON will be valid and you'll see two alert boxes. Edit: But yeah, my bad for
432.
by nbpoole 16y ago
And another: http://bit.ly/eN40yI Edit: Using a bit.ly link, since HN's URL parser is leaving out the closing ].
433.
by nbpoole 16y ago
http://fluin.com/?search=%22%3E%3Cscript%3Ealert%28%27XSS%27... A little security flaw ;)
434.
by nbpoole 16y ago
http://www.ipaidabribe.com/node/77 IpaidABribe.com is Janaagraha’s unique initiative to tackle corruption by harnessing the collective energy of citizens. You can report on the nature, number, pattern, types, location, frequency and valu
435.
by nbpoole 16y ago
The RewriteRules are also vulnerable to XSS. Try entering RewriteRule . /index.php<script>alert(document.location)</script> [L] and submitting a URL.
436.
by nbpoole 16y ago
...which is still somewhat disturbing :P
437.
by nbpoole 16y ago
Well, it appears that they're trying to track something more general than that. Whether that more general data is valuable or not is a different question. :-P
438.
by nbpoole 16y ago
I'm sure there's an innocent explanation! Maybe he was performing some "hands-on" research? :-P
439.
by nbpoole 16y ago
Short answer: no Lets take a look at the clickstreams for some non-porn websites: - http://www.alexa.com/siteinfo/google.com#clickstream - http://www.alexa.com/siteinfo/aol.com#clickstream - http://www.alexa.com/siteinfo/wikipedia.org#
440.
Reports from Google’s Vulnerability Reward Program(nealpoole.com)
10 points by nbpoole 16y ago|0 comments
441.
Looking for a co-conspirator(stdout.be)
4 points by nbpoole 16y ago|0 comments
442.
by nbpoole 16y ago
> (If you build an index on surname, firstname and dob, but execute select * from users where firstname="Bob" and surname="Jones", the index won't be used). I don't believe that's true, at least not for all RDBMS. I just checked the doc
443.
Using Static Analysis for Ajax Intrusion Detection(cs.brown.edu)
10 points by nbpoole 16y ago|1 comments
444.
by nbpoole 16y ago
Yeah, that was what I thought too. It was a very weird situation. And it was the only one of its kind that I found: I found other vulnerabilities, but none where CSRF tokens were presented but not validated. Edit: I should clarify that this