Recent
rfc in your pocket
I wanted to start reading the RFC 2616 HTTP/1.1, because who knows more about how HTTP works than the inventors right?! The only problem was, is that I hate reading large documents from screens, I lose concentration after very little time and end up on Twitter or some other social networking site.
So I started looking for printed RFCs, someone must have put these in a book?! Well, it turns out that I couldn’t find any. I thought about printing the entire RFC from my university library (£0.10 a page) however RFC 2616 contains 176 pages (£17.60 total). I remembered that OWASP use lulu.com for printing their awesome books, so I decided to print my own RFC and make it into a book. After many hours of trying to fit the A4 RFC into a pocket-size (4.25″ x 6.88″) book, getting the font size right, aligning the page numbers and getting the formatting just right on all 176 pages, ‘rfc in your pocket’ was ready to upload! After lots of trial and error with reformatting and trying to get the whole thing to fit I decided to order one for myself.
IE8 XSS Filter bypasses
When Microsoft launched their new Internet Explorer (IE) 8 browser in March of this year, it boasted a new security feature which filtered malicious scripting code to prevent reflected type 1 XSS attacks known as the ‘XSS Filter’.
Cesar Cerrudo, while IE8 was still in BETA found a way to bypass the filter by using a ’2 stage XSS attack’:
A 2 stage XSS attack is when the user has to browse to a second URL after browing the initial URL for the XSS attack to take place, people may think that this attack is compliated and not reliable but it’s simple and very realiable and has almost the same success rate as 1 stage XSS attack since people want to get what they were looking when browsing to the first URL they will continue browsing most of the time.
1 year on
Today is exactly one year on after posting my first post on the blog. I had a premature celebration (couldn’t hold the excitement) by changing the design as you have all probably noticed. I am still working on he re-design so there may still be some glitches here and there, bear with me.
I have come a long way since that first post and learnt a great deal. In 12 months I have created and managed DVWA to the success it is now with lots of help from the community. I have done talks, written articles and been a guest on some great podcasts. I completed my first year at university with the grade I set out to achieve and I am now half way through my second year still going strong.
All this I could not have achieved with out my friends, family and the online security community. The infosec community is always there to lend a hand and has opened up great opportunity’s for me. If you are an Ethical Hacking student or security professional and your not involved in the community, I cant stress enough how beneficial it is to contribute and learn from the amazing people that our out there. I would like to name names however there’s so many of you that have helped me I’m afraid I might miss some one out.
With out you the reader there would be no point in me keeping the blog updated with new posts, so please comment, give feedback and let me know what you would like to see more of. Also, don’t forget to subscribe! Blue box on the right. ;) –>
Again a big thank you to you all.
Securing your web applications
The World Wide Web and the applications that run on it have come a long way since the invention of HTML by Tim Berners-Lee (British man I might add) in the early 1990’s. Back then the World Wide Web was a static web of text, images and hyperlinks. Nowadays we have the privilege (sometimes not) of having whole communities which solely exist in a dynamically evolving cyberspace with wikis, blogs, social networking, video sharing and a lot more. “Web 2.0” would not exist without the complex web applications that run on the millions of web servers across the globe.
So how do we go about securing our web applications?
