I am building a single-page(React-Redux on FE, Rails-API BE) application which makes a bunch of REST API calls to get certain information for logged-in users. Some subset of that information (categorization database) is more confidential t…
Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don’t block img.
Theoretically, you can img src=’OFFSITE URL’, but what’s the worse that can happen? I know you can steal IPs with it, but is that it?
…
After I logout from my Outlook account, I get high frequency of “signing out error” reports, with the following message:
Hmm… we’re having trouble signing you out. You may still be signed in to some applications. Close your browser t…
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM unikernel thus replaces the operating syste…
In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs?
Signing each log entry is a possibility, but that does no prevent a malicious operator from hiding some of the logs.
I just received a "New sign-in" notification email from Google, saying
Hi UNKNOWN_PERSON,
Your Google Account UNKNOWN_ACCOUNT@gmail.com was just used to sign in from SOME_BROWSER on SOME_OS
Where UNKNOWN_PERSON and UNKNOWN_ACCO…
I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own JWTs. How can I crack the secret key of …
NIST SP 800-33 2.0.1 says that “availability” part of the CIA triad protects against intentional or accidental attempts to either:
perform unauthorized deletion of data or
otherwise cause a denial of service or data
This makes it pret…
First Hand Details
TEG (The Equation Group) is NSA’s team of hackers who’d write code to exploit systems worldwide. Some of the private files were recently dropped by a group called Shadow Brokers and they’ve auctioned it in exchange for B…
I created a android payload with public IP (android/meterpreter/reverse_https).
The stdapi commands(ls,cd,webcam_snap etc) are showing when the victim is in the same network.
But when I try to connect over the Internet( i.e. victim is in…
