shreeraj.blogspot.com

Shreeraj's security blog

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Sunday, May 12, 2013. CSRF and Cross Domain Response Extraction in Era of CORS. CORS has certain critical response headers. It is required if the application needs to share resources on a cross domain to other applications over Internet or Intranet. This type of scenario can lead to Cross Domain Response Extraction. For example application is sending following response header as part of HTTP. HTTP/1.1 200 OK Date...

http://shreeraj.blogspot.com/

OVERVIEW OF shreeraj.blogspot.com

TRAFFIC RANK

>1,000,000

REVIEWS

0

PAGES IN THIS WEBSITE

17

LINKS TO THIS WEBSITE

CONTACTS

ADDRESSES

SOCIAL LINKS

ONLINE SINCE

WEBSITE DETAILS

SEO

PAGES

SIMILAR SITES

TRAFFIC RANK FOR SHREERAJ.BLOGSPOT.COM

TODAY'S RATING

>1,000,000

TRAFFIC RANK - AVERAGE PER MONTH

BEST MONTH

June

AVERAGE PER DAY Of THE WEEK

HIGHEST TRAFFIC ON

Sunday

TRAFFIC BY CITY

Sign up

CUSTOMER REVIEWS

Average Rating: 3.9 out of 5 with 8 reviews

5 star

1

4 star

5

3 star

2

2 star

0

1 star

0

Hey there! Start your review of shreeraj.blogspot.com

AVERAGE USER RATING

Write a Review

WEBSITE PREVIEW

LOAD TIME

0.2 seconds

FAVICON PREVIEW

16x16
32x32
64x64
128x128

CONTACTS AT SHREERAJ.BLOGSPOT.COM

ADD CONTACT

Login

TO VIEW CONTACTS

Remove Contacts

FOR PRIVACY ISSUES

CONTENT

PAGES IN
THIS WEBSITE

17

SSL

EXTERNAL LINKS

34

SITE IP

216.58.216.193

LOAD TIME

0.219 sec

SCORE

6.2

PAGE TITLE

Shreeraj's security blog | shreeraj.blogspot.com Reviews

<META> DESCRIPTION

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Sunday, May 12, 2013. CSRF and Cross Domain Response Extraction in Era of CORS. CORS has certain critical response headers. It is required if the application needs to share resources on a cross domain to other applications over Internet or Intranet. This type of scenario can lead to Cross Domain Response Extraction. For example application is sending following response header as part of HTTP. HTTP/1.1 200 OK Date...

<META> KEYWORDS

1 shreeraj's security blog

2 pages

3 about me

4 authored books

5 papers/articles

6 slides

7 videos

8 blueinfy

9 iappsecure

10 esphere

CONTENT

Page content here

KEYWORDS ON PAGE

shreeraj's security blog,pages,about me,authored books,papers/articles,slides,videos,blueinfy,iappsecure,esphere,access control allow origin *,csrf countermeasures,posted by shreeraj,email this,blogthis,share to twitter,share to facebook,older posts

SERVER

GSE

CONTENT-TYPE

utf-8

GOOGLE PREVIEW

Shreeraj's security blog | shreeraj.blogspot.com Reviews

https://shreeraj.blogspot.com

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Sunday, May 12, 2013. CSRF and Cross Domain Response Extraction in Era of CORS. CORS has certain critical response headers. It is required if the application needs to share resources on a cross domain to other applications over Internet or Intranet. This type of scenario can lead to Cross Domain Response Extraction. For example application is sending following response header as part of HTTP. HTTP/1.1 200 OK Date...

INTERNAL PAGES

shreeraj.blogspot.com

1

Shreeraj's security blog: Blueinfy

http://shreeraj.blogspot.com/p/blueinfy-my-company.html

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Subscribe to: Posts (Atom). CSRF and Cross Domain Response Extraction in Era o. Awesome Inc. template. Template images by Alitangi.

2

Shreeraj's security blog: November 2011

http://shreeraj.blogspot.com/2011_11_01_archive.html

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Monday, November 28, 2011. CSRF with JSON – leveraging XHR and CORS. Here is a script which will do CSRF on cross domain. Here, we have “Content-Type”. As “text-plain”. And no new extra header added so CORS will not initiate OPTIONS to check rules on the server side and directly make POST request. At the same time we have kept credential to “true” so cookie will replay. On the wire we can see following request.

3

Shreeraj's security blog: November 2012

http://shreeraj.blogspot.com/2012_11_01_archive.html

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Thursday, November 08, 2012. XSS and CSRF with HTML5 - Attack, Exploit and Defense. HTML5 driven CSRF with XMLHttpRequest (Level 2). CSRF with two way attack stream. Cross Site Response Extraction attacks using CSRF. Cross Origing Resource Sharing (CORS) policy hacking and CSRF injections. DOM based XSS with HTML5 applications. Exploiting HTML5 tags, attributes and events. DOM variable extraction with XSS.

4

Shreeraj's security blog: March 2013

http://shreeraj.blogspot.com/2013_03_01_archive.html

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Monday, March 25, 2013. Cross Origin Resource Sharing Policy and its impact. Cross Origin Resource Sharing (CORS) policy is introduced in HTML5 specification. It allows control over cross domain calls and the application can control over the resource or content. CORS. Similarly, when applications send the response back over HTTP, they will also add a range of headers. The browser can take decisions based on these...

5

Shreeraj's security blog: January 2013

http://shreeraj.blogspot.com/2013_01_01_archive.html

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Saturday, January 19, 2013. HTML5/Browser Evolution and Threats. It all started in 1991 when HTTP and HTML came into picture and browser started to evolve. From that time onwards several new set of technologies gradually coming into the browser as per requirements. By introduction of HTML5 it has bounced to the next level. Here is a quick curve of technologies with time. Figure 1 - HTML5 Evolution. Awesome Inc. t...

UPGRADE TO PREMIUM TO VIEW 12 MORE

TOTAL PAGES IN THIS WEBSITE

17

LINKS TO THIS WEBSITE

buayacorp.com

AJAX – Buayacorp

https://www.buayacorp.com/categorias/ajax

Web 20 Hacking, Defending Ajax & Web Services. Presentación 'Web 2.0 Hacking, Defending Ajax & Web Services' de Shreeraj Shah hecha en el evento HITB 2007 - Dubai. El título hace referencia a una presentación de Shreeraj Shah. Hecha en el evento. Este material se complenta bastante bien con el que puse la semana anterior sobre XSS, CSRF y Ajax Hacking. Espero que lo disfruten 😉. 1 Comment on Web 2.0 Hacking, Defending Ajax & Web Services. Semanas atrás reportaron un bug XSS en ASP.NET 2.0. Para los inte...

wschess.blogspot.com

wsChess Toolkit: [External] Beta 1.1

http://wschess.blogspot.com/2005/04/external-beta-11.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Internal] wsRook and wsAudit. Paper for wsRook methodology - IHttpModule. Internal] wsProxy tool released. Paper on methodology for wsPawn. Tuesday, April 26, 2005. External] Beta 1.1. Following changes are made. 1 Threaded engine in place. 2 GUI thread is different from core.

wschess.blogspot.com

wsChess Toolkit: Releasing beta 1.2

http://wschess.blogspot.com/2005/05/releasing-beta-12.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. External] Beta 1.1. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Internal] wsRook and wsAudit. Paper for wsRook methodology - IHttpModule. Internal] wsProxy tool released. Paper on methodology for wsPawn. Tuesday, May 17, 2005. Releasing beta 1.2. Changes are as follows. Posted by shreeraj @ 5:37 AM.

wschess.blogspot.com

wsChess Toolkit: December 2004

http://wschess.blogspot.com/2004_12_01_archive.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. Book - Hacking Web Services. Domain footprinting is branched out into MSNPawn. Releasing beta 1.4. Releasing beta 1.3. ASPNET web services advisory. Releasing beta 1.2. External] Beta 1.1. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Monday, December 20, 2004. Posted by shreeraj @ 7:55 PM.

wschess.blogspot.com

wsChess Toolkit: March 2005

http://wschess.blogspot.com/2005_03_01_archive.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. Book - Hacking Web Services. Domain footprinting is branched out into MSNPawn. Releasing beta 1.4. Releasing beta 1.3. ASPNET web services advisory. Releasing beta 1.2. External] Beta 1.1. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Wednesday, March 30, 2005. Paper for wsRook methodology - IHttpModule.

wschess.blogspot.com

wsChess Toolkit: [Internal] Beta 1.1 released

http://wschess.blogspot.com/2005/04/internal-beta-11-released.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. WsChess 1.0 (beta/prototype) - Web Services Assess. Internal] wsRook and wsAudit. Paper for wsRook methodology - IHttpModule. Internal] wsProxy tool released. Paper on methodology for wsPawn. Monday, April 18, 2005. Internal] Beta 1.1 released. Posted by shreeraj @ 9:52 AM.

security-rk.blogspot.com

..: Hacking Web 2.0 Applications with Firefox

http://security-rk.blogspot.com/2009/11/hacking-web-20-applications-with.html

วันจันทร์ที่ 23 พฤศจิกายน พ.ศ. 2552. Hacking Web 2.0 Applications with Firefox. AJAX and interactive web services form the backbone of “web 2.0” applications. This technological transformation brings about new challenges for security professionals. This article looks at some of the methods, tools and tricks to dissect web 2.0 applications (including Ajax) and discover security holes using Firefox and its plugins. The key learning objectives of this article are to understand the:. This technological shift...

buayacorp.com

CSRF – Buayacorp

https://www.buayacorp.com/categorias/csrf

Múltiples vulnerabilidades en la última version estable de WordPress MU. Wordpress MU comparte los mismos problemas de seguridad que Wordpress. Es una versión de WordPress que soporta múltiples blogs. Tanto WordPress como WordPress MU comparten gran parte de código y por lo tanto, es lógico que casi siempre sufran los mismos problemas de seguridad*. Luego de mirar un rato el código de la última versión estable de WordPress MU, veo que el. Un problema similar existe entre menéame. De varios blogs que usab...

wschess.blogspot.com

wsChess Toolkit: Releasing beta 1.3

http://wschess.blogspot.com/2005/06/releasing-beta-13.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. ASPNET web services advisory. Releasing beta 1.2. External] Beta 1.1. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Internal] wsRook and wsAudit. Paper for wsRook methodology - IHttpModule. Internal] wsProxy tool released. Monday, June 06, 2005. Releasing beta 1.3. 2 Buffer overflow - Specify parameter and buffer size.

wschess.blogspot.com

wsChess Toolkit: Domain footprinting is branched out into MSNPawn

http://wschess.blogspot.com/2006/01/domain-footprinting-is-branched-out.html

Objective of this blog is to keep track of wschess activities and place holder for knowledge base. It is web services assessment and defense toolkit. Releasing beta 1.4. Releasing beta 1.3. ASPNET web services advisory. Releasing beta 1.2. External] Beta 1.1. Internal] Beta 1.1 released. WsChess 1.0 (beta/prototype) - Web Services Assess. Internal] wsRook and wsAudit. Paper for wsRook methodology - IHttpModule. Internal] wsProxy tool released. Wednesday, January 11, 2006. Whitepaper is included for bette...

UPGRADE TO PREMIUM TO VIEW 24 MORE

TOTAL LINKS TO THIS WEBSITE

34

OTHER SITES

shreerageng.com

Shreerag Engineering & Auto Pvt.Ltd.

We Specialize in Producing Customized Trollies and components As per the Requirements of the customer. All our products are ISO 9001-2000 Certified and having good networks of sales and services all over India. Our view to reduce costing of final product through better quality management. Manufacturing and designing of material handling pallets. And others heavy duty fabrications. Value for money for our clients. Timely servicing of their needs.

shreeraghavendraswamymadalayam.org

Welcome shreeraghavendraswamymadalayam.org - BlueHost.com

Web Hosting - courtesy of www.bluehost.com.

shreeraghulogistics.com

Shree Raghu Logistics Pvt. Ltd. - Home

Welcome to Shree Raghu Logistics Pvt Ltd. Shree Raghu Logistics Pvt. Ltd. is the most innovative logistics company that reaches out to provide comprehensive logistics solutions. The young and dynamic management team at Shree Raghu Logistics Pvt. Ltd. contributes greatly with their unique thinking, by adapting the latest technology, applying the advanced and modern methods in the field to cater the growing needs of the customers. Raquo; Read More. Raquo; Read More. We have expertise in offering our custom...

shreeraghunathwires.com

Welcome to Shree Raghunath Wires, Baddi, Himachal Pradesh, India

Plot No. 176, HPSIDC, Industrial Area. Baddi, Himachal Pradesh, India. Ph: 91-1795-247176, 91-9872499938. Dealers invited in all regions of india. Welcome to Shree Raghunath Wires. Shree Raghunath Wires, a leading name in wire manufacturing industry established in Baddi, Himachal Pradesh, India, offers a comprehensive range of superior quality wires like HB Wire, HHB Wire, Binding Wire,Annealed Wire. Besides this, we also trade in Wire Rods. Our modern infrastructure facilities managed by experienced per...

shreeraghupublicity.com

:: Shree Raghu Publicity ::

A good basic selling idea, involvement and relevancy, of course, are as important as ever, but in the advertising din of today, unless you make yourself noticed and believed, you ain't got nothin'. Leo Burnett. With the blessing of Late Shree Raghuvar Dayal Gupta. Shreeraghupublicity.com All right reserved. Site Design and Developed by : Raj Infotech Solutions.

shreeraj.blogspot.com

Shreeraj's security blog

This blog is created to keep track of my activities and place holder for sharing. Enjoy! Sunday, May 12, 2013. CSRF and Cross Domain Response Extraction in Era of CORS. CORS has certain critical response headers. It is required if the application needs to share resources on a cross domain to other applications over Internet or Intranet. This type of scenario can lead to Cross Domain Response Extraction. For example application is sending following response header as part of HTTP. HTTP/1.1 200 OK Date...

shreeraj.org

Welcome to Shreeraj Pharmaceuticals

Is engaged in the research, development, manufacture and supply of medicines that aim to make a real difference to the lives of Indians. We focus on the following health care areas: cardiovascular, diabetes, gastrointestinal, neuroscience, oncology, respiratory, anaesthesia and pain management. Our business is driven by our mission to bring new innovative medicines into peoples’ lives. We are committed to working collaboratively to achieve our goal of better health for patients. Areas where we serve.

shreeraja.com

Shree Raja Engineers - Contact Us

Diamond Wheels, PCD and CBN Wheels, Carbide Cutting Tools, Coated Abrasives and Chemicals - The One Stop Shop for all your Cutting Tool Needs. Shree Raja Engineers has been incorporated with the primary objective of providing appropriate tooling solutions to enable the Industrial engineers to gather information, reduce cost and to increase production. Today Shree Raja Engineers has more than 50 satisfied and regular customers in Karnataka and Gujarat. A few of our Customers. Tusaco Pump Ltd., Gujarat.

shreerajaldesargaushala.com

Shree Rajaldesar Gaushala

श र र जलद सर ग श ल ,र जलद सर. ग य : एक पर चय. ग य एक गत म न म द र ह त त स कर ड ह द द व -द वत ओ क सम ह क न व स. ग य ज क एक चलत फ रत अस पत ल ह , न अम ल य औषध क र प म प चगव य द य ह. ख ल-क द, ध र म क अन ष ठ न , अर थव यवस थ और हम र भ वन त मक स थ रत म सह यक ह. अत प र च न क ल स ग य क भ रत य सम ज म एक व श ष ट स थ न ह. Powered By Sigma Web Solution, Sikar.

shreerajameeragold.in

Sri Raja Meera Gold Station

Professional Slideshow Software by WOWSlider.com v2.4. 2428 INR /gm (22 Ct). 3800 INR /gm (22 Ct). SHREE RAJA MEERA GOLD. SHREE RAJA MEERA GOLD. SHREE RAJA MEERA GOLD. No,386, Main Road,. Near Old Bus Stand,. Phone : 04632 222746, Fax No : 04632-225297,. Mobile No: 9443348869,9442248864,9442248863.