New article on Sicherheit-Online
Today, my new article about some XSS findings on four single portals was published on the website Sicherheit-Online.org
Enjoy yourself :)
Entries tagged as artikel
check point sicherheit abra security HTTPS Intrusion Prevention OpenBSD OpenSSH Cisco coding steganographie reverse engineering challenges advisory cross site scripting icinga nagios saarland xss nessus lfi sql injection full path disclosure metasploit infoserve directory traversal http polipo proxy buffer overflow backdoor denial of service dos bypass cross site request forgery heise owasp adobe omniture open redirection apple.com store.apple.com cheat sheet html5 bug bounty markplaats.nl Sicherheit openbsd openssh animal shelters animals cats dogs donate hunde
My new article on heise Security
Here is my newest article, published on heise Security.
This time it’s about the Web-Security tool "CSRFTester" from The Open Web Application Security Project (OWASP). It’s a short overview how to use the CSRFTester to identify "Cross Site Request Forgery" vulnerabilites in web applications.
Here is the link to the article: http://heise.de/-1735223
Enjoy yourself!
HAKIN9 IT Security Magazin - 12/2011
Well, here is my next article for the German HAKIN9 IT Security Magazin. This time it’s about Web-Security and it holds three examples (XSS, SQL-Injection and Blind SQL-Injection) about, how to identify and fix vulnerabilites in web applications. Tools used for this one are Netsparker Community Edition from mavitunasecurity, Arachni and sqlmap.
And of course not to forget, a big special THANKS to Dr. Philip Walter for his great support!
Enjoy yourself!
Cross-site scripting (XSS) - What's that and how to identify them?
On my blog are some vulnerabilities called "Cross-site scripting" or "XSS", but what exactly is a Cross-site scripting?
A Cross-site scripting attack is a type of a html injection and the problem is always when a web application accept user input and generates the output without validating or encoding it. This flaw makes it possible for an attacker to inject a malicious script – like javascript – to access cookies, session tokes or some other sensitive information stored in the user’s browser, because it thinks the script came from a trusted source.
They are some different possibilties to identify XSS vulnerabilities:
- use a web security scanner, like xsser, arachni, Nikto …
- test/review the code for places with user input which possibly ends into HTML output (contact forms, search forms …)
A Cross-site scripting attack is a type of a html injection and the problem is always when a web application accept user input and generates the output without validating or encoding it. This flaw makes it possible for an attacker to inject a malicious script – like javascript – to access cookies, session tokes or some other sensitive information stored in the user’s browser, because it thinks the script came from a trusted source.
They are some different possibilties to identify XSS vulnerabilities:
- use a web security scanner, like xsser, arachni, Nikto …
- test/review the code for places with user input which possibly ends into HTML output (contact forms, search forms …)
Network Security - Check Point IPS SoftwareBlade - HTTPS Inspection
With the R75.20 release, a Check Point Security Gateway is ready for HTTPS inspection (Supported blades: Data Loss Prevention (DLP), Anti Virus, Application Control, URL Filtering, and IPS).
Further information can be found here:
https://www.checkpoint.com/campaigns/r75.20/index.html
https://www.checkpoint.com/products/softwareblades/intrusion-prevention-system.html
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk65123
Enjoy yourself!
HAKIN9 IT Security Magazin - 07/2011
My second article "Mobile security – Secure workspaces with Check Point Abra" is published in the latest edition of the security magazine hakin9.
So, here’s the free download – http://de.hakin9.org/magazine/1748-mobiles-internet
Further information, about Check Point Abra, can be found on the Check Point website – http://www.checkpoint.com/products/abra/
Enjoy yourself ;) !