Collaborate Disseminate
I have a website with the following code:
<input class="Header–search–form-input" name="search" value="" onfocus="alert(1)" autofocus="" placeholder="put request&q… Continue reading How to launch XSS code from an INPUT tag?
Web development can be a lucrative and challenging career. See our top picks for courses that can introduce you to the field and kick-start your job search. Continue reading The 5 Best Web Development Courses Worth Taking in 2024
My question regards tabnabbing and how to block it. I will first describe my understanding of the subject, but I’m no expert, so this introduction is meant for you to correct me if applicable.
Here is my attempt at exhaustively listing the… Continue reading Tabnabbing, adblocking and web browser security
I’ve been trying all day to nest created iframes and access their contents, but security restrictions dont let me. Is there a way? I shared my code and everything i tried so far in a codepen. https://codepen.io/serapath/pen/qBGbpMG?editors… Continue reading How to access iframe.contentWindow.document of a nested iframe inside an iframe? [migrated]
I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["’self’"],
scriptSrc… Continue reading Bypassing CSP and implementing XSS attack
Do you really need that cloud hosting package? If you’re just running a website — no matter whether large or very large — you probably don’t and should settle for …read more Continue reading On Cloud Computing And Learning to Say No
I’m interested in CVE-2022-0801, however the report is evasive.
Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page.
Is there any … Continue reading What was the root cause of CVE-2022-0801? [closed]
I might have found a way to highjack an Oauth Flow, but the source server is responding with 403 errors when the Oauth request is sent with a Sec-Fetch-Dest HTTP header.
Is there a way to alter or disable such headers like the referer poli… Continue reading Is it possible to disable or change sec-fetch-* HTTP headers?
I want to be 100% secure, I create raw html this way:
const template = document.createElement(‘template’)
template.innerHTML = html_raw
const cloned = template.content.cloneNode(true)
document.querySelector(‘#app’).appendChild(cloned);
W… Continue reading Secure way to output encoding HTML for insert raw html via javascript
I’ve seen people in security saying URLs with Cyrillic characters are dangerous. If you ever type such characters on a browser you’d see they break into crazy unrecognizable URLs that have nothing to do with the original name.
Another atta… Continue reading Are Cyrillic characters a real threat?