Popular Posts
-
This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounti... -
(on HNews) Basically, browsers often suggest you to save your password and prefill it automatically. The bug I just discovered: This value c...
-
TL;DR: In Firefox regexps with 999 998+ groups return false, no matter was the given string valid or not. It seems like a performance opti... -
TL;DR ///host.com is parsed as relative-path URL by server side libraries, but Chrome and Firefox violate RFC and load http://host.com inst...
-
A while ago I found leaking document.referrer vulnerability and even used it to hack Facebook. It's Chrome's XSS Auditor again (sev...
-
J.Crew is sending out yet another email, reminding customers that they are still running 4 0% off Final Sale (& 50% off select items) w... -
From official doc on Cross Origin Resource Sharing A header is said to be a simple header if the header field name is an ASCII case-ins... -
Remember OAuth1 session fixation? No? Read writeup from Eran Hammer (the guy who hates OAuth2 as much as I do). Guess what - there's ex... -
Playing with 302-based header injection (majority of web servers is not vulnerable to it btw) i found one tricky neat bug which can be reall...
