p42.us

websec.wordpress.com

Papers | Reiners' Weblog

https://websec.wordpress.com/papers

Anything about Web Security. Code Reuse Attacks in PHP: Automated POP Chain Generation. Johannes Dahse, Nikolai Krein, Thorsten Holz. 21st ACM Conference on Computer and Communications Security (CCS). Scottsdale, Arizona, USA, November 2014. Best Student Paper Award *. Static Detection of Second-Order Vulnerabilities in Web Applications. Johannes Dahse, Thorsten Holz. 23rd USENIX Security Symposium. San Diego, CA, USA, August 2014. Internet Defense Prize *. Johannes Dahse, Thorsten Holz.

kuza55.blogspot.com

Web Security Research» Alex's Corner: Is framework-level SQL query caching dangerous?

http://kuza55.blogspot.com/2008/08/is-framework-level-sql-query-caching.html

Sunday, August 03, 2008. Is framework-level SQL query caching dangerous? I was in a bookshop a few months ago and picked up a book about Ruby on Rails, and though I sadly didn't buy it (having already bought more books than I wanted to carry) and I've forgotten it's name, there was an interesting gem in there that stuck in my head. But in any case, it still seems dangerous. Assuming that flushing the cache is fairly granular operation (or there is very little activity on the table or users are stored as ...

kuza55.blogspot.com

Web Security Research» Alex's Corner: April 2008

http://kuza55.blogspot.com/2008_04_01_archive.html

Saturday, April 12, 2008. How much do you trust your DNS operator? TechCrunch recently broke a story about Network Solutions hijacking users' unused subdomains for advertising. It seems to have only applied to people using Network Solutions for their shared hosting, and seems to have been removed now. (None of the IPs I tested on the same machine returned advertising for their non-existent subdomains) And on top of that we know that anyone who is on shared hosting is pretty easy pickings. Now you may tru...

kuza55.blogspot.com

Web Security Research» Alex's Corner: Using TinyURL For Storage (includes PoC)

http://kuza55.blogspot.com/2006/12/using-tinyurl-for-storage-includes-poc.html

Saturday, December 30, 2006. Using TinyURL For Storage (includes PoC). Note: To skip to the PoC click here. I recently read the following post about trying to write something that took advantage of pdp's article of using tinyURL for storage: http:/ michaeldaw.org/news/news-221206/. Sadly at the time I hadn't actually read pdp's article ( http:/ www.gnucitizen.org/blog/the-attack-of-the-tiny-urls/. But that still leaves us with the problem of having a cross-domain browser security policy, whereby we can't...

kuza55.blogspot.com

Web Security Research» Alex's Corner: July 2008

http://kuza55.blogspot.com/2008_07_01_archive.html

Sunday, July 27, 2008. EDIT]:It turns out I fail at testing things on the latest version, see comments for some more details, sorry about that Roee.[/EDIT]. Roee Hay recently posted a blog post on the Watchfire blog about an XSS bug in the Tamper Data extension. It was posted much earlier, but removed quickly; RSS is fun), however when he assessed the impact he was wrong. The context of the window is still within the extension, and so by executing the following code you can launch an executable:. 1 If yo...

kuza55.blogspot.com

Web Security Research» Alex's Corner: August 2008

http://kuza55.blogspot.com/2008_08_01_archive.html

Wednesday, August 06, 2008. Thoughts on the DNS patch/bug. Is it just me, or does the DNS patch only seem to buy us more time? At most this decreases the chance of a succesful attack 65k times, at worst it doesn't help because of NAT, and if you're running a default MS. Also seem to say it works pretty damn quickly. I'm not going to do any figures, but given how network speeds seem to go constantly upwards (or do we want to speculate about an upper cap? For your typical attack, yes, poisoning random subd...

kuza55.blogspot.com

Web Security Research» Alex's Corner: It's been a while

http://kuza55.blogspot.com/2008/09/its-been-while.html

Thursday, July 16, 2009. It's been a while. In any case, I did some presentations recently and thought I should probably put details up here. I also did a talk at RUXCON and 25c3 with Stefano Di Paola. And I even spelled his surname correctly this time! Called Attacking Rich Internet Applications, so here are some materials:. Here is the PoC exploit:. This is just a PoC, have a look through about:config for any string entry you would want to change. Header ("HTTP/1.1 200 OK BR B Mime Type /B : text/h...

kuza55.blogspot.com

Web Security Research» Alex's Corner: January 2008

http://kuza55.blogspot.com/2008_01_01_archive.html

Saturday, January 19, 2008. 24c3 Presentation and Research. I did a presentation entitled Unusual Web Bugs. A few weeks ago, for which you can find slides and video for on the first link. However, since some of the things I presented were some of my own research which I haven't posted anywhere, I'll write a couple of posts about that in the next couple of days. There isn't too much though, so there's no need to get your hopes up, and if you've seen the video, you already know it. Links to this post.

kuza55.blogspot.com

Web Security Research» Alex's Corner: Dynamic XSS Payloads in the face of NoScript

http://kuza55.blogspot.com/2008/09/dynamic-xss-payloads-in-face-of.html

Wednesday, September 24, 2008. Dynamic XSS Payloads in the face of NoScript. While participating in the CSAW CTF. So, in light of that, I was thinking of how we could load our payload from off-site, without the remote site running JavaScript. Of course, I am assuming you have already bypassed NoScript's XSS Filters (e.g. because the attack was persistent), but this information is particularly useful for persistent attacks when you may want to change the payload. Wednesday, September 24, 2008. It could be...