Tweet Tweet!

Have not been able to blog much lately, but have been doing more of microblogging on Twitter.  So...you can follow me there ;)

http://twitter.com/g54zw00dcy4u1ls

Frustrated by a coworker’s use of old-school programming techniques

Saw this article in TechRepublic, and it's pretty good actually.

Though it talks about working with coworkers who code really differently, the human aspect of handling this problem can be just about applied anywhere also.

Academic Earth

Here's another endeavour to bring free education out to the masses.  Good mission, I'd say :)

http://www.academicearth.org/

http://www.academicearth.org/about

TODO: Check out XSS Proxy

Some things to check out when I have a bit of time to spare:

http://xss-proxy.sourceforge.net/

http://xss-proxy.sourceforge.net/Advanced_XSS_Control.txt

http://hackathology.blogspot.com/2007/10/xss-proxy-poc.html

http://www.securiteam.com/tools/5UP0G0UEVO.html

http://ha.ckers.org/blog/20060718/attacking-applications-via-xss-proxies/

http://ha.ckers.org/blog/20070710/xss-proxy-tunnelling/

Oh yeah, and this is a real gem :)

Server/network admins be warned...XSS can be really bad for you too...

http://holisticinfosec.blogspot.com/2008/08/cross-site-scripting-can-be-used-to.html

Assessment Methodology

Done by hitechpo on House of Hackers blog.

[Parts 1, 2, 3, 4 and 5]

Introduction to reverse engineering

Done by n2u in House of Hackers blog.

[Part 1]
[Part 2]

Cool hack: Man exploits random deposit verification flows to steal $50,000

This is really really impressive, though on a serious note it's not that funny for a system to be so poorly designed and implemented.

Link: http://www.cgisecurity.com/2008/05/12

Suggestive

Was looking for the meaning of the word "obviate" on the net, and I found this ad in one of the sites. Really really suggestive..



For your info, the word obviate means to do away with something (unnecessary).

NetBeans 6.1 does JavaScript editing

Wow...

http://www.netbeans.org/download/flash/js/javascript_demo.html

Click Crime

I seldom write about articles that I read, preferring to share them in my Google Reader or put the link in my Twitter. But I'll make an exception here:

http://www.securityfocus.com/columnists/471

Mark Rasch gives a very good description on "criminal honeypots" some of it's possible implications worldwide if implemented on a larger scale. The difference between setting up a trap and entrapment is talked about here also.

From the web application security perspective, it would be possible to frame someone else not only by using social engineering, but also even attacks like this:

1. Create javascript code in a site that you control that exploits CSRF weaknesses in the criminal honeypot. Wait for the target to access your site and "click" the link automatically.
2. Create a site that's linked to your target somehow, and get many many people to click on the link (to the criminal honeypot) that you put in the site. The FBI sees the referrals from that site, and traces it to your victim.

Google XSS

Billy Rios has published one that he found in Google. Pretty exciting eh (not in the wrong way!) =O

Netcraft has a shorter version of the details also. Quoted below:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

An interesting cross-site scripting (XSS) vulnerability found in the Google Spreadsheets service would have allowed attackers to gain unauthorised access to other Google services, including Gmail and Google Docs.

The vulnerability was discovered by security engineer Billy Rios, and takes advantage of nuances in the way Internet Explorer handles Content-Types for webpages.

When a spreadsheet is saved and downloaded in CSV format, the Content-Type is set to "text/plain", thereby instructing the client's browser that the document should be treated as plain text. However, if HTML tags are entered into the first cell of the spreadsheet, Internet Explorer detects these tags near the start of the CSV document and instead deduces that it should be treated as HTML. This essentially allowed arbitrary HTML webpages to be served from spreadsheets.google.com, which in turn allowed JavaScript to be executed in the context of the spreadsheets.google.com site. A remote attacker could exploit this weakness by stealing the user's session cookies and hijacking their session.

Rios points out that Google cookies are valid for all google.com sub domains. This means that when a user logs in to Gmail, the Gmail cookie is also valid for other Google services, such as Google Code, Google Docs, Google Spreadsheets, and more. Cross-site scripting vulnerabilities in any of these sub domains can allow an attacker to hijack a user's session and access other Google services as if they were that user.

Google has fixed the vulnerability discovered by Rios and there have been no reports of the vulnerability being exploited by attackers.

WireShark 1.0.0 is out

Get it here!

[Link to PortableApps WireShark package]

Chickenfoot for Firefox

Chickenfoot is a Firefox extension that puts a programming environment in the browser's sidebar so you can write scripts to manipulate web pages and automate web browsing. In Chickenfoot, scripts are written in a superset of Javascript that includes special functions specific to web tasks.

Send e-mail with your Cisco router

A helpful tool network admins could use for alerting: configuring your Cisco router to send emails.

10 traits to look for when you’re hiring a programmer

From TechRepublic's blogs. ;)

Bridging the Designer-User Gap

From Jakob Nielson's Alertbox. A good read for anyone involved (even minimally) in user interface design.