Collaborate Disseminate
Backstory:
I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about information security, so when I see my comput… Continue reading Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious
I have found myself with the need to block online conversion tools for pdf files and such, but I can’t think of a nice catch-all (or even catch most) solution (without blocking all file uploads in browsers). Does anybody have any ideas on … Continue reading Blocking online file conversion tools
I am writing a program that creates BPF seccomp filters. These filters are supposed to check syscalls and their arguments against predefined allowed values. The logic to check the syscall by its number works as expected. However, the logic… Continue reading How to dump the input of a seccomp BPF filter?
I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites.
I was wondering how does Zscaler manage to do this? I read that it creates a PAC file that is saved on your system which cont… Continue reading How Zscaler enables system wide proxy?
I am studying cybersecurity by CompTIA, and having trouble understanding some topics regarding Egress Filtering methods:
Allow only whitelisted application ports and, if possible, restrict the destination addresses to authorized Internet … Continue reading Egress Filtering
I was just wondering if this code is enough to prevent XSS vulnerability in my web app?
/**
* Escape HTML string to prevent XSS.
*/
export const escapeHtml = (string: string): string => {
if (isString(string)) {
const enti… Continue reading XSS Prevention Code
I’m working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address.
Since I’ve read that Snort only works in layer 3, I would like to know if it’s possi… Continue reading Suricata and rules based on MAC address
There is a standard XSS exploitation technique where one can use javascript keyword in <a href=””> to execute javascript code. Example:
<a href=”javascript:alert(42);”>please clickme</a>
Let’s us consider PHP code wh… Continue reading Is XSS possible when using htmlspecialchars and https prefix check in href?
Right now I am redirecting all local network DNS traffic to my Pi-hole install, since some device do or may in the future use hardcoded DNS servers to bypass filtering.
Since DNS-over-HTTPS and DNS-over-TLS are becoming more common, I wou… Continue reading Can I intercept DNS-over-HTTPS (DoH) or -TLS (DoT) in my home network?
On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing; ?type=<script<script>>alert(1)</script<script>>
Which gave me a homepage which presented me with the headline-text… Continue reading XSS filter bypass < and/or <