Introduction Cross-Site Scripting (XSS) has been around for ages – with first incidents being reported in the late nineties. Despite the attack technique not being the most complex of all, XSS is not only still around in 2011 but has gained incidence and gravity. In many real life attacks XSS was used as an entry-door […]

The problem as I see it Where to start? Let me start by telling you that most of the books you read are wrong. The code samples you copy of the internet to do a specific task are wrong (the wrong way to handle a GET request), the function you copied from that work colleague […]

I woke up yesterday morning and had a sudden flash of inspiration to stop all social network worms. I dunno why I wasn’t even researching them, I’ve no idea how my mind works it’s funny like that. Anyway sometimes I have bad ideas and sometimes they’re good. I like to discuss them all because that’s […]

I hate to use the word Ajax because there’s no XML involved just nice JSON but Hackvertor now has Ajax applications! At the moment it’s very rough around the edges but it will improve when I get more spare time to work on them. What does it mean? Well you can now share actual HTML/JS […]

I love to think of unsolvable problems and try to solve them. I dunno why I just enjoy it. One of the most challenging problems is “secret questions”. Everyone sucks at this, I’m looking at you Google. One of the first lines of defence for a unverified account can be a secret question. This is […]

I was thinking about how to prevent a user being exploited lately by whatever method. One thing most attacks have in common is that a user generally needs to initiate the attack by clicking on a email or web site link from a social network. There’s a obvious pattern here. Granted some attacks are conducted […]

I’ve just seen on the news today about German supermarkets using biometric data like fingerprints to purchase goods. The claims of increased convenience and the ability to earn points by just using your finger. All sounds good to the average consumer but what would happen if this method was used instead of debit/credit cards? In […]

I like the topic of CSRF because it’s such a difficult problem to solve, I was thinking about ways a browser can prevent CSRF and I’ve come up with the following solutions:- 1. After a domain name any image/object/frame etc request is truncated by a user definable setting. Limiting the amount of data an attacker […]

Introduction I hope you found my posts on the Safari security holes interesting, in this post I’m going to try and explain how I think and how I managed to work out an exploit for Safari. This post will be unusual for me because generally I try to keep my writing short and sweet, but […]

Ok I apologise for the cheesy title but it’s all that I could think of 🙂 a mate of mine asked me to do a post on how to protect your browser when you’re online so here goes. First off it’s impossible. That’s right impossible, you can’t make your browser 100% secure, all you can […]