Collaborate Disseminate
I am studying for the CCNA and I touched on the topic of star (client-server) vs mesh (p2p) networks. I read in some articles that one of the advantages of a mesh network is the level security and privacy it provides, but did… Continue reading What is a more secure network topology, star or mesh? [on hold]
I needed to stop an XSS attack from happening when the payload is inserted into the URL as a parameter. In this case though, there are no script tags. This is my URL which causes an XSS attack:
localhost/example/file.jsp?… Continue reading How to stop JS from executing when passed in as a parameter to the URL? (no script tags)
I needed to stop an XSS attack from happening when the payload is inserted into the URL as a parameter. In this case though, there are no script tags. This is my URL which causes an XSS attack:
localhost/example/file.jsp?… Continue reading How to stop JS from executing when passed in as a parameter to the URL? (no script tags)
I have a XSS payload that successfully ran the javascript when I pasted the URL in browser and hit enter. This is the URL:
localhost/path/to/file.jsp?aMessage=%3Cscript%3Ealert(%27XSSed%27)%3C/script%3E
Where aMessage gets… Continue reading Is it possible to perform a XSS attack in the title/subtitle of a webpage?
In an XSS attack (proof of concept for pen testing reasons), the following string is appended to a url:
;alert(String.fromCharCode(88,83,83));(1
I understand what the ;alert(String.fromCharCode(88,83,83)) does (it just cre… Continue reading What is the need for the ;(1 in this XSS payload?
Recently Red Hat fixed an important vulnerability in sudo:
https://access.redhat.com/security/cve/cve-2017-1000367
From the description:
A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with
privileges to execute commands via sudo could use this flaw to
escalate their privileges to root.
I wonder what the regular user should do to “use this flaw”?
Is it a simple operation?
Continue reading How user can change the tty information (related to CVE-2017-1000367)
Is there any point to store a Certificate in a TPM?
From what I understand a certificate is public knowledge. The only concern about certificates is accepting a rogue certificate.
Are boot measurements checked against PCRs by the TPM, or is the PCR is reported and the measuring software does the check?
Since the PCR validation enables the release of some secrets in the TPM, I guess it must be done b… Continue reading How are PCRs Checked and are external TPMs vulnerable to hardware attack
RFC3647 describes the difference between a CPS and a CP as follows:
The main differences between CPs and CPSs can therefore be summarized
as follows:
A PKI uses a CP to establish requirements that state what par… Continue reading PKI: Difference between CPS and CP
I’m building an app and a server. The server is a node.js API with a Postgres backend.
Images created in the app will be stored at Amazon S3. Metadata about the files will be stored in Postgres.
I have zoomed in at two poss… Continue reading File encryption design