[SANS ISC] Malicious Code Can Be Anywhere

Today, I published the following diary on isc.sans.edu: “Malicious Code Can Be Anywhere“: My Python hunting rules reported some interesting/suspicious files. The files are named with a “.ma” extension. Some of them have very low VT scores. For example, the one with a SHA256 dc16115d165a8692e6f3186afd28694ddf2efe7fd3e673bd90690f2ae7d59136 has a score of 15/59.

The post [SANS ISC] Malicious Code Can Be Anywhere appeared first on /dev/random.

Continue reading [SANS ISC] Malicious Code Can Be Anywhere

With Response header having content-type: application/json, is it still possible to trigger XSS?

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS?
This is a language neutral question, it can be Java,PHP,ASP,Node,Python, etc.
The X-Content… Continue reading With Response header having content-type: application/json, is it still possible to trigger XSS?