I’m trying to fully understand the concept behind CSRF, and more importantly, how to protect against it.
Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value of the random anti-CSRF token I insert i…
This is not a has-badBIOS-pwn3d-me post, so don’t worry about any paranoid rants.
Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS uses for communication (some type of s…
After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I don’t have any file upload handling func…
Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem).
(source)
Yes I know that the solution is to "install and use a HTTP server for local…
We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (ACM).
One of our clients is concerned ab…
I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning.
As seen here Bypassing Trustwave NAC, it looks like a good method, but I don’t simply get it. With ARP poisoning, the NAC device should send …
Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc…
Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a Rowhammer attack (on X86, ARM, via JavaScr…
Need some inputs for the CSRF token design to prevent anti-automation.
When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part of the Get Response of Page Load.
The id…
I am currently trying to figure out just how key hierarchies in a TPM 2.0 work. I read that there are four possible hierarchies (storage, endorsement, platform, null). I also read, that these hierarchies form key trees with a parent key en…
