Popular Posts
-
TL;DR ///host.com is parsed as relative-path URL by server side libraries, but Chrome and Firefox violate RFC and load http://host.com inst...
-
Playing with 302-based header injection (majority of web servers is not vulnerable to it btw) i found one tricky neat bug which can be reall...
-
TL;DR We (me and @isciurus ) chained several different bugs in Facebook, OAuth2 and Google Chrome to craft an interesting exploit. Mallory... -
Remember OAuth1 session fixation? No? Read writeup from Eran Hammer (the guy who hates OAuth2 as much as I do). Guess what - there's ex... -
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying o... -
From official doc on Cross Origin Resource Sharing A header is said to be a simple header if the header field name is an ASCII case-ins... -
Try to run this simple app: require 'sinatra' get '/' do redirect params[:to] if params[:to].start_with? 'http://host....
-
" Thanks! " to many of you, who shared the following promotion for J.Crew Factory. J.Crew is offering Factory Store shoppers a... -
J.Crew is sending out yet another email, reminding customers that they are still running 4 0% off Final Sale (& 50% off select items) w...
