Web App Security (webappsec) Mailing List

[White Paper] Abusing HTML 5 Structured Client-side Storage

Mon, 21 Jul 2008 02:57:01 +0200

Posted by Alberto Trivero on Jul 21

The aim of this white paper is to analyze security implications of the
new HTML 5 client-side storage technology, showing how different
attacks can be conduct in order to steal storage data in the client’s
machine.
Download at: http://trivero.secdiscover.com/html5whitepaper.pdf

...

Re: RE: Web Pen Test Honeypot

16 Jul 2008 21:08:21 -0000

Posted by mike_at_cenzic.com on Jul 16

('binary' encoding is not supported, stored as-is) To add one more to the fray...

Cenzic has one available off their web site.

http://crackme.cenzic.com/

mikekaz

-------------------------------------------------------------------------
Sponsored by: Watchfire...

RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 11:51:37 +0100

Posted by Martin ONeal on Jul 16

> Yes I did; but it doesn't
> change the fact that your
> comments under "Testing"
> in that section (page 16)
> are still not applicable to
> c#. Nor is the "Recommendation"
> about ==. As I said.

LOL; you would like a testing and...

Re: Auditing mailing scripts for web app pentesters

Wed, 16 Jul 2008 11:31:15 +0100

Posted by Adrian Pastor on Jul 16

Hi Brett,

I came across this paper a while ago but had forgotten about it! Will
definitely keep it in mind for future assessments.

What percentage of ASP.NET/MS SQL environments would you say you find
vulnerable to this attack against "forgotten password" facilities?

Also, have you...

Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 20:07:35 +1000

Posted by silky on Jul 16

On Wed, Jul 16, 2008 at 8:02 PM, Martin O'Neal
<martin.oneal_at_corsaire.com> wrote:
>
> > this is fairly stupid.
>
> LOL; more stupid than vacuous name calling, or less?

I'd say it's on par with it :)

> > what financial institutions are
> > using...

RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 11:02:43 +0100

Posted by Martin ONeal on Jul 16

> this is fairly stupid.

LOL; more stupid than vacuous name calling, or less?

> what financial institutions are
> using floating point and not decimal
> variables to represent their money?
> very few i'd guess. it hardly needs
> to be said that anyone using FP
>...

RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 10:46:05 +0100

Posted by Martin ONeal on Jul 16

> you don't ever need to round, and
> can use relatively simple fixed-
> precision for this sort of thing.

Sometimes. Some financial calculations, such as exchange rates etc, are
inherently floats.

Martin...

...

RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 10:42:59 +0100

Posted by Martin ONeal on Jul 16

> Have you reported these issues to Sun/Microsoft?

These are all by-design issues, that have side-effects for the unwary.

Martin...

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security...

Re: Paper draft: Enough With Default Allow in Web Applications!

Wed, 16 Jul 2008 10:09:15 +0100

Posted by Adrian Pastor on Jul 16

Ivan, I agree with you 100% but as you said it's easier said than done.
I think that a lot of insecure configuration settings are forgotten to
be fixed when moving from a UAT to a production environment.

You might want to take a look at the following:

...

RE: Auditing mailing scripts for web app pentesters

Wed, 16 Jul 2008 15:08:29 +1200

Posted by Brett Moore on Jul 16

Hi.

While not directly related to your papers topic. I think it would
be beneficial to raise awareness of the issue illustrated in this
paper by Gary O'Leary-Steele.

http://www.sec-1labs.co.uk/advisories/BTA_Full.pdf

Surprising how many forgotten password mail out features are vulnerable
to...

Re: Recommended training course?

Wed, 16 Jul 2008 02:48:51 +0000 (UTC)

Posted by Johannes B. Ullrich on Jul 16

/* disclaimer: I work for SANS */

Take a look at http://www.sans.org. Plenty of courses to choose from. I will not comment on quality as I work for them. Essentially all of them include hands on exercises and can be taken live or online. I will gladly provide more information off-list.

Most...

Re: usabilty vs sescurity - return urls by parameter

Wed, 16 Jul 2008 15:12:59 +0300

Posted by Gleb Paharenko on Jul 16

Hi.

That seems to be a part of "open redirects problem" which was
discussed a lot on this list.

2008/7/15 MC Iglo <mc.iglo_at_googlemail.com>:
> Hi all,
>
> lately, I see more and more pages using get-parameters to store a
> return url after login.
> two...

CFP now open for ClubHack2008 - India

Tue, 15 Jul 2008 15:46:20 +0530

Posted by ClubHack on Jul 15

Dear all
We are pleased to announce the opening of CFP for ClubHack2008.
ClubHack is India's own international hackers' convention started in 2007.

We are expecting good deep knowledge technical
presentations/demonstrations on topics from the world of Information
Security.

These...

Re: Recommended training course?

Tue, 15 Jul 2008 22:48:05 -0400

Posted by Kevin Johnson on Jul 15

On Jul 13, 2008, at 1:18 AM, Jimmy Liang wrote:
> Hello,
>
> I’m looking at expanding my security knowledge and am looking for
> recommendations on training courses. I’ve had a few years of Windows
> and Solaris admin experience managing 30 or so 24/7 systems, and
>...

Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)

Wed, 16 Jul 2008 10:08:03 +1000

Posted by silky on Jul 16

On Tue, Jul 15, 2008 at 11:02 PM, Martin O'Neal
<martin.oneal_at_corsaire.com> wrote:
>
> Breaking the Bank
> (Vulnerabilities in Numeric Processing within Financial Applications)
>
> By Adam Boulton, Stephen De Vries, Kevin O'Reilly, July 15, 2008
>
> This...