Showing posts with label firefox. Show all posts
Showing posts with label firefox. Show all posts
Tuesday, March 19, 2019

[🌐💧💥] HTTP Cache Cross-Site Leaks

›
In this blog post I want to talk about a cool type of attacks ( XSLeaks ) that are cooler than what most developers and security researchers...
Wednesday, January 25, 2017

Fighting XSS with 🛡 Isolated Scripts

›
TL;DR : Here's a proposal for a new way to fight Cross-Site Scripting vulnerabilities called  Isolated Scripts . You have an open-source...
Tuesday, December 27, 2016

How to bypass CSP nonces with DOM XSS 🎅

›
TL;DR  - CSP nonces aren't as effective as they seem to be against DOM XSS. You can bypass them in several ways. We don't know how ...
Monday, May 25, 2015

[Service Workers] New APIs = New Vulns = Fun++

›
Just came back from another great HackPra Allstars , this time in the beautiful city of Amsterdam. Mario was kind enough to invite me to ...
Sunday, September 22, 2013

[Matryoshka] - Wrapping Overflow Leak on Frames

›
(Update Feb 25, 2018: Google Drive deprecated web hosting, so the PoCs below don't currently work. I'll fix them soon, in the meanti...
Thursday, October 15, 2009

A couple of unicode issues on PHP and Firefox

›
Well, here I am developing ACS, finding that this project resembles at some degree the creation of a browser.. but anyway, it's close to...
Tuesday, August 04, 2009

Our Favorite XSS Filters and how to Attack them

›
So well, Black Hat 2009 and DEFCON 17 are over now, and on Black Hat I presented twice, so I want to do a quick recap. If you asisted to ...