sirdarckcat

Here's a new version of the last post code for hijacking IE6 and IE7 iframes. Aparently some versions of IE where fixed, (the code didnt...

Due to the news that there are a few ghost busters on the wild, and no one is willing to tell us exactly what's the ghost about, I...

Well, after talking with David Ross about the last post (bypassing content-disposition), I found out that it's exploitation wasn't a...

Well first of all I want to congrats my friend kuza55 because of his talk "Unusual Web Bugs" at 24c3, was a success. I watched it ...

Well, the last couple of days I've been playing with hi5. It's pretty cool, and I found a couple of XSS vulnerabilities. I reported ...

This week, I've sort of improoved the CSK of Gareth Heyes , with a few more event handlers, and interoperability with Opera (and menus!...

Well the research made for the exploit for the joke for rsnake is sort of interesting, so I'll try to explain what was needed (even do i...

Well, this are the bugs at Google services that even do are fixed now, where around for a while. First I have to say that the Google Securit...

Well, I want to explain first, this was not my idea, someone at irc.irchighway.net/#slackers discussed about this a while ago, but he wasn...

yay, I wanted to be part of this hell of a week (Google's Dark Week). Here is the vulnerability I reported to google, and it appears ...

Hi, some days ago I watched John Resig Tech Talk, about building a JavaScript library , where he pointed out some "good habits", w...

Well, a response time of 1 week, is said to be good, Mozilla has 10 f***ing days , Google depending on the complexity of the vulnerability t...

A couple of days ago, at elhacker.net , they showed a project, for finding SHA-1 collisions. After I registered, I found out that there was ...

This is the first of 3 parts of the document entitled: " JavaScript is just evil ". Here are the first 2 chapters. 1.- DoSing the ...

Here I present a file that will appear different depending on which application you open it. As plain text, it will describe how it works, a...

It's rather simple.. and it deals with vulns at the "server level" (no sqli, rfi, xss, etc..) anyway.. http://code.google.com/...

3 days ago, I found out that there was a way of Popping up the Firefox JavaScript Error Console, by doing: <iframe src="javascript:...

While making estigma 's function EditHTML() (a WYSIWYG editor), I realized that the code modified, will stay on cache, until you close t...

Last Week, I found Google Wireless Transcoder , and I started playing with it trying to find a XSS bug in the HTML "transcoder", a...

Long time ago, when I was learning C, and I understood the use of pointers, I started thinking if there was a way to pass the JavaScript var...