Collaborate Disseminate
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is .app so I’m forced to use a certificat… Continue reading A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
Google have written up a great explanation of XSS attacks with 3 interactive demos:
https://www.google.co.uk/about/appsecurity/learning/xss/
If I follow the instructions, I can see a JavaScript alert pop-up in the first 2 demos however whe… Continue reading DOM-based XSS example doesn’t work
Google have written up a great explanation of XSS attacks with 3 interactive demos:
https://www.google.co.uk/about/appsecurity/learning/xss/
If I follow the instructions, I can see a JavaScript alert pop-up in the first 2 demos however whe… Continue reading DOM-based XSS example doesn’t work
I’d like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I’d like to offer users the option of using a yubikey to safeguard the data. This way it would… Continue reading Protect server-side key with client token
TLDR;
Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in.
Have I been pwned ?
I just found a terrifyingly easy way to view pages that should be visible… Continue reading Does copying cookies allow attackers to view pages that should be visible only after login?
I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app.
After researching, I believe the best wa… Continue reading How to securely store users API keys submitted through client
I’m planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS exclusively. To make this convenient for develope… Continue reading OAuth for command line application
SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF?
Thanks everyone.
Continue reading Can display a GIF in <img> tag causing Client-side DOS
I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following:
"Encrypting the personal_information and phon… Continue reading Why would you use random algorithm for CSFLE if you can’t query the inserted data?
I’m already into web pentesting. I’m willing to learn android pentesting now.
From what I understand, the server side part like API etc is similar to web pentesting and I need to learn about client side bugs.
Am I correct?
Continue reading Is android pentesting partially similar to web pentesting?