Collaborate Disseminate
My question regards tabnabbing and how to block it. I will first describe my understanding of the subject, but I’m no expert, so this introduction is meant for you to correct me if applicable.
Here is my attempt at exhaustively listing the… Continue reading Tabnabbing, adblocking and web browser security
I’ve been trying all day to nest created iframes and access their contents, but security restrictions dont let me. Is there a way? I shared my code and everything i tried so far in a codepen. https://codepen.io/serapath/pen/qBGbpMG?editors… Continue reading How to access iframe.contentWindow.document of a nested iframe inside an iframe? [migrated]
I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["’self’"],
scriptSrc… Continue reading Bypassing CSP and implementing XSS attack
Do you really need that cloud hosting package? If you’re just running a website — no matter whether large or very large — you probably don’t and should settle for …read more Continue reading On Cloud Computing And Learning to Say No
I’m interested in CVE-2022-0801, however the report is evasive.
Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page.
Is there any … Continue reading What was the root cause of CVE-2022-0801? [closed]
I might have found a way to highjack an Oauth Flow, but the source server is responding with 403 errors when the Oauth request is sent with a Sec-Fetch-Dest HTTP header.
Is there a way to alter or disable such headers like the referer poli… Continue reading Is it possible to disable or change sec-fetch-* HTTP headers?
I want to be 100% secure, I create raw html this way:
const template = document.createElement(‘template’)
template.innerHTML = html_raw
const cloned = template.content.cloneNode(true)
document.querySelector(‘#app’).appendChild(cloned);
W… Continue reading Secure way to output encoding HTML for insert raw html via javascript
I’ve seen people in security saying URLs with Cyrillic characters are dangerous. If you ever type such characters on a browser you’d see they break into crazy unrecognizable URLs that have nothing to do with the original name.
Another atta… Continue reading Are Cyrillic characters a real threat?
A have a multilingual website in English and Arabic. I add the redirection code in .htaccess but only English pages are redirected and my (sub directory ar) its not working.
I want to know how I can solve this issue.
RewriteEngine On
Rewri… Continue reading add redirection to directory and subdirectory [migrated]
I need to create a link using Python or HTML. When I open this link in the browser, I want javascript to be enabled automatically in my browser’s settings. How can I use HTML for this?
Continue reading Automatically enabling javascript in the browser using the link? [closed]