Tagged “security”
-
TIL how to build a chrome extension that steals everything security extension pii keystroke
There's 3 components that will be used - background Service worker, Content script, and popup.
-
TIL executing a xss using a SVG image image svg security xss
This user was able to upload a '.svg', that then executed a xss attack to steal local storage data.
-
TIL How to steal localData using an XSS attack security xss mdn
But that's just a red flag that opens the door to bigger issues.
-
TIL types of malicious npm attacks security npm malware
In the case of ionicons, the miscreants published 18 versions containing malicious form-stealing code; for example, icon-package (according to NPM download stats) has over 17,000 downloads. Other typo-squatting examples include umbrellaks instead of umbrellajs and so on.
-
TIL malware in node_modules malware npm security hacking
The very first line fetches the victim's country code using their IP address. If the victim is from Russia, Ukraine, Belarus, or Kazakhstan, then the malware exits early.
-
TIL all the different security roles roles security certifications
In appsec most notably offense vs defense. They are complimentary of course but the skills differ. For offense you need specific tools, need to get used to testing applications sometimes without source code access.
-
TIL fingerprinting with CSS security css
Fingerprinting refers to building up enough metadata about a user that you can essentially figure out who they are. JavaScript has access to all sorts of fingerprinting possibilities, which then combined with the IP address that the server has access to, means fingerprinting is all too common.
-
TIL CSRF Attacks security hack forms
Cross-site Request Forgery (CSRF) is submitting post data from a fake site. To prevent CSRF attacks, web applications should implement measures such as requiring a valid CSRF token to be included with each request, checking the referer header, and using secure cookies.
-
TIL Microsoft Teams can analyze your feelings ai security
Microsoft Teams set up a new feature set. They're known as Purview classifiers that can help prevent abuse, harassment, other illegal activities on Teams.
-
TIL how to create randomware in nodejs security hacking node
As a developer, it's important to know the power we have in our hands, and how to execute and defend against it/avoid it. Running randomware attacks is illegal.
-
TIL about going up and down in your bash history commandline terminal security
Your bash history is saved with up/down arrow keys. Which means you shouldn't save your passwords on it.
-
TIL CSS Vulnerability in Yahoo Mail css security vulnerability email
CSS doesn't immediately fail on parse errors. In 2009 it turned out Yahoo Mail was vulnerable to a fairly simple exploit. The attacker sends the user one email with a snippet of code and another email to run the code
-
TIL how CORs work security vulnerability webdev
We kinda need images to work regardless of what site they're on. I should be able to steal a image from your website and host it somewhere else. Same with JS code (Like CDNs!) But we also don't want the problem above where I can test your cookies to see if you're logged into your bank account.
-
TIL obvious security vulnerabilities and prototype pollution vulnerabilities security javascript
Object-based inheritance gives JavaScript the flexibility and efficiency that web programmers have come to love – but it also makes it vulnerable to tampering. Malicious actors can make application-wide changes to all objects by modifying object, hence the name prototype pollution.
-
TIL Never deserializing untrusted data php security vulnerability json
This happened the most in PHP, because for some reason, PHP developers love to serialize/deserialize objects instead of using JSON, but I’d say almost every case we saw where a server was deserializing a client object and parsing it led to a horrible exploit.
-
TIL what the Diffie-Hellman Key exchange is algorithm security
SSH uses RSA to establish an initial secure, authenticated connection, then uses Diffe-Hellman to establish an ephemeral (ie: one time) key to establish forward-security.
-
TIL the word Sanitize is too overloaded xss security language developer
Sanitize means too different things, depending on context. Use Filtering, Escaping, Validation, or Protect instead.
-
TIL a JWT decoder and how it works security json jwt
JWT (JSON Web Tokens) are essentially just JSON objects that are hashed. This site decodes them and explains how it works
-
TIL Netflix's method of providing internal tooling at scale security netflix operations
Netflix had a problem. Before any program can be deployed, it had to run through a rigorous security checklist.
See all tags.