web security

IT Security central point of conferences

2012-01-08T20:55:00.001+01:00

Practically there is no place around the world focusing on IT Security conferences. I did not know anything like this ever, so I created a calendar of events (most interesting from my point of view) on this blog. Unfortunately, updates and keeping it fresh was too much time consuming so stopped him updating. Fortunately, in the wild has appeard the great service secore.info, which aggregates

More accurate framebusting

2011-07-16T10:52:00.048+02:00

I would like to draw attention to use of framebusting in many websites. Modern browsers with HTML5 support require a different approach to this problem. Briefly I would like to remind you that framebusting is a technique to protect against so called clickjacking (wiki). Commonly there are used two methods to avoid this attack vector: HTTP header X-FRAME-OPTIONS with values DENY or

Chrome, anti-XSS filter bypass

2011-05-27T19:13:00.003+02:00

In Chrome web browser was found the design flaw that can be used to make universal XSS attacks. The bug is in the same time a browser feature because it is used for code completion, which was just poorly coded (i.e. missing something small such as a closed tag or quotation). So in this code: <img src=1 onerror=alert(1);character will be replaced to allow proper execution code snippet for example

Essential for pentester

2011-04-26T23:53:00.008+02:00

I add to the stuff a few JavaScript scripts that can help in the rapid encoding or decoding of characters HTML and more (click) There are only a few though but it was fast written and the list of scripts will increase. If you need any additional tools or hand-saw things to have here or other proposals - let me know.

Welcome

2011-04-17T11:51:00.001+02:00

It happened. I forced myself to breathe life into this site:) First of all it should be mentioned a word about websec and why websec. I don't like greetings so it will be brief. WebSec is a special case of information security. Special because of the popularity of web applications. These days most of the technology arrangements "for the people" are created mainly in web technologies. Why?