Category Archives: encoding

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

Posted on by

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be stored in the database but the payload … Continue reading Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?→

How to Find Encryption when knowing Input Plain Text and Output Encrypted Text? [duplicate]

Posted on by

When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint.
For example, if I enter the following CR ID :
"CR-13261150"
it POSTs the following Encrypted Data:
splainText : &q… Continue reading How to Find Encryption when knowing Input Plain Text and Output Encrypted Text? [duplicate]→

How to decode/decrypt/decipher an unknown 83 bytes long UDP payload?

Posted on by

This is my first post here.
Following problem, maybe someone has time and knowledge to help a little bit with a hint.
Problem statement: I have an unknown 83 bytes long payload which I would like to decode/decrypt/decipher…
I got an alarm … Continue reading How to decode/decrypt/decipher an unknown 83 bytes long UDP payload?→

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

Posted on by

I have a java web app. I’m using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I’m new to this so I’m not sure on how to test on my web app for the following scenarios where there’s no dire… Continue reading How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?→