Collaborate Disseminate
I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I tried many resources for solution from … Continue reading Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution
One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin.
One reason is because of phishing attacks, ok I understand. But if I were an attacker and the ta… Continue reading Why we should not allow our pages to be loaded through Iframe by unknown hosts?
There’s no question that surface-mount technology has been a game-changer for PCB design. It means easier automated component placement and soldering, and it’s a big reason why electronics have gotten so cheap. It’s not without problems, though, particularly when you have no choice but to include through-hole components on your …read more
I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header Location: in response. So for e… Continue reading Referer value reflected in location response?
I’m currently developing a webservice that sits in between other webservices. In the process of securing this webservice I’ve gotten a bit stuck on whether or not we neeed to require a CSRF token on its endpoints. This webser… Continue reading Is a CSRF required if no direct state change operations are performed?
My organisation is adding a firewall to our test stacks, using AWS WAF. We’d like to whitelist all traffic from the SDKs we’ve built to facilitate requests between our services.
We thought of doing this using a custom ‘X-‘ … Continue reading ‘Hard-to-guess’ custom header (or similar) to whitelist via a firewall
Consider a scenario where a POST request is completed successfully for a request with specific user-agent. The only protection against the CSRF at the endpoint I am testing is user-agent.I want to create an CSRF POC for the s… Continue reading Setting user-agent for CSRF [on hold]
I have a website to do security testing. The CSP is as follows.
default-src * ;
style-src ‘self’ ‘unsafe-inline’ data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
script-src ‘self’ ‘… Continue reading Is using default-src * safe?
about attacks like this where the do change the router dns using malicious code on fake sites or ads … how these sites were allowed to access the router while routers doesn’t have
Access-Control-Allow-Origin response head… Continue reading how did hackers do the CSRF router hacking while CORS policy exist?
script-src-attr and script-src-elem directives are new additions in CSP3.
I am not able to understand how are they different from the script-src directive.
https://w3c.github.io/webappsec-csp/#directive-script-src-elem
This documents the… Continue reading CSP: What is script-src-attr and script-src-elem?