Collaborate Disseminate
There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the JSON object is directly used by client si… Continue reading XSS not exploitable when POST data is sent in JSON?
There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the JSON object is directly used by client si… Continue reading XSS not exploitable when POST data is sent in JSON?
According to the JWT RFC a JWT can optionally have a JTI which I interpret to be a unique ID for a JWT. It seems like a UUID is a good value for a JTI. The RFC claims that the JTI can be used to prevent the JWT from being replayed. Two que… Continue reading How does JTI prevent a JWT from being replayed?
I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it’s okay that people know what they are) but we do want to (… Continue reading Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs
I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it’s okay that people know what they are) but we do want to (… Continue reading Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs
Recently Patrick Wardle published an analysis of a new Backdoor and Dropper used by HackingTeam. It looks like the samples mentioned in the blog were found in-the-wild, so we decided to see how this latest Backdoor works. Continue reading The return of HackingTeam with new implants for OS X
MongoLab has long been the de facto service for deploying and managing MongoDB databases, but now that the company has cornered this market, it’s looking to expand into new areas. Before launching any new products, though, the company decided to change its name from MongoLab to mLab. MongoLab/mLab CEO and co-founder Will Shulman tells me that he always saw MongoLab as the first part of… Read More Continue reading MongoLab Changes Its Name To mLab As It looks Beyond Database Management
I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only agent that knows the secre… Continue reading JSON Web Tokens – How to securely store the key?
The application I’m running a security assessment on encodes POST requests as follows:
POST /foo/save HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 6652
<snip&g… Continue reading JSON and form-urlencoded encoded payloads in Burp Intruder
I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId.
The problem I facing can be summarized as:
How can I determin… Continue reading Securing a multi-tenant, multi-database REST API