sirdarckcat
Tuesday, December 27, 2016
How to bypass CSP nonces with DOM XSS 🎅
›
TL;DR - CSP nonces aren't as effective as they seem to be against DOM XSS. You can bypass them in several ways. We don't know how ...
Saturday, December 10, 2016
Vulnerability Pricing
›
What is the right price for a security vulnerability? TL;DR: Vendors should focus on vulnerabilities, not on exploits. Vulnerabilities sho...
Monday, March 28, 2016
Creating a Decentralized Security Rewards Market
›
Imagine a world where you, a security researcher, could make money on your open source contributions, and your expertise about the security ...
Sunday, October 04, 2015
Range Responses: Mix, Match & Leak
›
Hey! The videos from AppSec 2015 are now online, and the Service Workers talk is too. Anyway, this post is about another of the slides in...
Tuesday, September 22, 2015
Not about the money
›
This applies to all posts in this blog, but just as a reminder. What I say here doesn't necessarily have to reflect the opinions of my ...
Wednesday, May 27, 2015
[Service Workers] Secure Open Redirect becomes XSS Demo
›
This is the shortest delay between blog posts I've had in a while, but I figured that since my last post had some confusing stuff, it...
Monday, May 25, 2015
[Service Workers] New APIs = New Vulns = Fun++
›
Just came back from another great HackPra Allstars , this time in the beautiful city of Amsterdam. Mario was kind enough to invite me to ...
‹
›
Home
View web version
