Notes & research

Blog

Application security, curious findings, and lessons from the details.

October 7, 2013

Catch-up on Flash XSS exploitation – bypassing the guardians! – Part 1

September 28, 2013

Simple Security Tip: window.location = window.location.pathname can cause Open-Redirect issue!

Microsoft XMLDOM in IE can divulge information of local drive/network in error messages – XXE

IE/Firefox Redirection Issue – FB Oauth2 Bypass – BugCrowd

November 28, 2012

File in the hole! – HackPra slides

November 12, 2012

XSS by uploading/including a SWF file

October 18, 2012

Don’t trust a string based on TryParse or IsNumeric result! (.Net/VBScript)

August 14, 2012

IE9 Self-XSS Blackbox Protection bypass

Microsoft IIS tilde character “~” Vulnerability/Feature – Short File/Folder Name Disclosure

Browsers Anti-XSS methods in ASP (classic) have been defeated!