RSnake

For a more "developer" oriented discussion of the same topics, I recommend the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 another great resource is RSnake's blog: http://ha.ckers.org

I tried it with the WordPress rewrites ( http://codex.wordpress.org/Using_Permalinks ) and I couldn't get it to work. I think the problem is that I didn't know what to put in REQUEST_FILENAME. I tried the following: REQUEST_FILENAME: I tried blank, "year/month/day/post-name" and "/year/month/day/post-name". URL: year/month/day/post-name (to give hostname/year/month/day/post-name). Rewrite rules copied from the WP link above: # BEGIN WordPress <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> # END WordPress I got one no match and two rules skipped. EDIT: You have an XSS vulnerability in the URL field. Use the first test from this list: http://ha.ckers.org/xss.html .

One of the better recent sites has been RSnake's: http://ha.ckers.org/ But he just retired from blogging about netsec and is done with the industry, I think (a lot of ppl get sick of it, I left the sec industry 10+ years ago and never looked back)

Yeah, sites like http://www.didyouwatchporn.com/ and http://ha.ckers.org/weird/CSS-history-hack.html fail to work in Firefox 4. The followup bugs are more to do with tuning what is allowed and what isn't, e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=559722.

The Top-10 is just a start. As a penetration tester and sometimes-trainer, I find it's when developers start to see practical demonstrations of what these vulnerabilities can actually allow a malicious party to achieve that the eyes really get opened. Particularly when those demonstrations are within their own applications. Check out the rest of the OWASP site, and play with WebGoat (http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project). Take a look at the 'Web Security' section here: http://code.google.com/edu/courses.html Start following some of the many webappsec blogs floating around the interwebs, subscribe to mailing lists, read tweets: http://www.gnucitizen.org/ http://ha.ckers.org/ http://jeremiahgrossman.blogspot.com/ http://www.webappsec.org/lists/websecurity/ http://twitter.com/#search?q=%23WebAppSec There is a huge amount of information out there.

This post follow along the same lines, however a bit more blackhat[1]. He also did another write up about using images to store xss data a while back. It is great if the image is loaded into javascript, other wise it will not work. http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getima…

Some potential mitigating factors, if you break it up as follows: * a tiny anchor HTML page with data key info * a general purpose .js file (or small number of such) * template HTML pages * content (e.g. - JSON) The tiny "anchor" page should be small (latency still hurts, of course); The JS should be cached locally once the app has been used for the day; The HTML templates pages should also cache; The content must be loaded, suffering latency -- however, if the content is large, your app can display something while the content is being generated (perhaps by a big, slow, legacy data source???). Another consideration: if all content is delivered via a REST API as JSON or (ugh) XML, there is a better chance it will be properly encoded for display. Hopefully, I can save a nice JavaScript fragment in a submission to said site, and the AJAX page construction code will simply add it to the resulting page to be displayed, rather than to be run. Hmmmm, perhaps I want my testing fixtures to fill the test database with XSS samples while I am at it, such as the newer entries in http://ha.ckers.org/xss.html (or a more recent list), and then to display that data on a few pages of manual testing.

Just a public service announcement-- for those of you looking to validate your own site for XSS exploits, you'll find that this list is particularly good at giving you "problem" strings to test against: http://ha.ckers.org/xss.html We honestly thought we secured XSS with common libraries on every field for one of our sites, but we paid a contractor to go through and use those strings in various unexpected places and they found a few special and unobvious spots that fell between the cracks. Don't think you're immune just because you use all the right frameworks and input sanitation tricks. Even the best web developers are going to mishandle things from time to time. If you think it's irresponsible for Twitter to miss some XSS vulnerabilities, you better be doing this testing on your sites, too, before someone else does and calls you out on it. If you're not testing at least the easy user input exploits, you don't really know how protected you are.

Do you mean plugins such as Flash and Java? These can be enumerated with Javascript code in Gecko/WebKit browsers[1]. AFAIK there's also something similar for IE. When it comes to extensions such as HTTPS Everywhere and AdBlock etc I don't think it's supposed to be possible. Some extensions may unintentionally leak information that can be used to detect them though[2]. What are you trying to do? [1] https://developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins.plug… [2] http://ha.ckers.org/blog/20060823/detecting-firefox-extentions/

For deployment, it's also important to have something like nginx in front of Gunicorn to buffer requests from slow clients. Otherwise, this sort of thing can DoS your server pretty bad: http://ha.ckers.org/slowloris/

Slowloris is also the name of a deny of service tool: http://ha.ckers.org/slowloris/

Interestingly the "enumerator" tool doesn't list all my extensions, and it lists even less when testing on the machine running the beta channel (18). Similar behavior Firefox exhibits regarding: http://ha.ckers.org/weird/firefox-extentions.html

I wouldn't trust this service, because I can't find any information about who is running this service - at least not in the few minutes I have spend clicking around on their site. Maybe there is some info somewhere, I have not found it. In another comment a quote from a different article was mentioned regarding the Terms of Service. I could not find a page about the terms of service. Maybe it's me, but I think that these informations should be easy to find on a site. Some other interesting points about this service are explored in an article by rsnake from ha.ckers.org: http://ha.ckers.org/blog/20100104/anonymous-proxy-woes/ "So yeah, please don’t use CGI proxies, unless you really know what you’re doing. They really very rarely increase your security. Most of the time, they just decrease it, as a matter of fact."

Actually, it's not easy. It's incredibly difficult to have a webapp with a wide range of functionality that doesn't leak data to SQL injections. There's plenty of stuff that can get past the precautions you listed[1][2], although pornel is closer to the mark. [1]http://ha.ckers.org/sqlinjection/ [2]https://docs.google.com/viewer?url=http://www.ihteam.net/papers/blind-…

OWASP (such as testing guide) would be a good place to start or simple books such as Innocent Code / Web hacking Exposed. Having prior experience in server-side coding will help massively. Just like many other professions hacking/breaking is all about practising - you can safely hone your skills on these : http://ha.ckers.org/blog/20090406/hacking-without-all-the-jailtime/

Doesn't that mean you only need to control http://ha.ckers.org/s.js (or similar) rather than write a book?

But not all of these can: http://ha.ckers.org/xss.html. This is an older, but much more complete list.

Well, I don't have a ready reference for SQL injections, but how about one for XSS? http://ha.ckers.org/xss.html If that doesn't teach you anything, well, my hat's off to you.

LOIC is complete junk. It's just a crappy TCP/UDP/HTTP attack tool. They are only strong because of the sheer number of them. A handful of people using a quality tool like Rsnake's "slowloris" (http://ha.ckers.org/slowloris/) could do much more damage. Anyone remember smurf attacks? (http://en.wikipedia.org/wiki/Smurf_attack) now that was epic. LOIC is lame.

Something I’ve considered but never implemented: A "Submit to HN" button that is only visible if the HN frontpage is in the visitor's browser's history. (Yes, this is possible: http://ha.ckers.org/weird/CSS-history-hack.html) Benefit: Avoids mainstreaming HN. Drawback: thafman & similarly-minded users would react the same way to the button on blog.fairsoftware.net; that is, it's begging for social media promotion. Thoughts? (PG?)

i think most of that has been summarized at http://ha.ckers.org/xss.html

Well, nginx started because Apache devs didn't want to address the issue that arised when lots of users with slow connections were accessing the site. Anyone else remember the Slowloris HTTP DoS - ngingx is basically immune to it... As Sysoev was working for one of the Russia's biggest portals that apache couldn't handle very well.. So he wrote a server that did one thing very well - waits until client submits their request and then serves this request as fast as possible. And he did it well :) Slowloris HTTP DoS - http://ha.ckers.org/slowloris/

Slowloris DoSes sites using low bandwidth. http://ha.ckers.org/slowloris/

More info about this attack is available on http://ha.ckers.org/blog/20090617/slowloris-http-dos/

Wow am I ever not OK with browser security demonstrations that crash my browser. From the JS, It looks like this is just this old trick: http://ha.ckers.org/weird/CSS-history-hack.html

This is as trivial as XSS attacks get. Third on the XSS cheat sheet: http://ha.ckers.org/xss.html

You should also look at the XSS cheat sheet http://ha.ckers.org/xss.html

So even if Scala is ahead in this (flawed) benchmark, that's not how you write a TCP server in Scala, because you want to do it non-blocking. Not doing it based on asynchronous I/O means that in a real-world scenario the server will choke under the weight of slow connections, not to mention be susceptible to really cheap DoS attacks like Slowloris [1]. Seriously, it goes beyond the underlying I/O API that you're using. If anywhere in the code you're reading from an InputStream or you're writing to an OutputStream that's connected to an open socket, then that's a blocking call that can crush your server. Right now, every Java Servlets container that's not compatible with the latest Servlets API 3.1 can be brought down with Slowloris, even if under the hood they are using NIO. Option A for writing a server in Scala is Netty [2]. Option B for writing a server in Scala is the new I/O layer in Akka [3]. [1] http://ha.ckers.org/slowloris/ [2] http://netty.io/ [3] http://doc.akka.io/docs/akka/snapshot/scala/io.html

Good old server-status, which is switched on an open to all in the default httpd.conf in Apache. Taken alone this isn't much to worry about - it is unwanted information spillage. But it gives away enough information that could be useful as part of another attack. Since it logs URLs being hit, it can show private URLs - such as those that depend on randomly generated tokens to access data (eg. photobucket photos) or to determine the structure of a backend admin app. It can also expose sessions in apps that use tokens in URL query parameters where cookies are not allowed (ironically something that older versions of PHP did by default). It is also useful in measuring the progress of a DoS attack, especially with slorloris[1]. All of the standard web security scanners check for this page, and rate the severity of the information leak as moderate. What is surprising here is that it hasn't been discovered earlier, considering how often large sites such as php.net would be scanned by such scanners. That would suggest that this is a temporary configuration glitch, or something that they don't mind being publicly accessible due to the type of content hosted on php.net and the fact that it is mirrored by volunteers anyway. It would be much more interesting if this happen to, say, Twitter. It did, and I wrote about it at the time (I got a bit carried away, cringe: http://techcrunch.com/2009/10/21/twitter-you-say-transperancy-i-say-vu… They closed it up quickly. To…

Isn't this better? http://ha.ckers.org/xss.html