Security

Ok, so I was bored and I added very very basic HTTP support to vsftpd. vsftpd is now perhaps the only FTP server to have an option ftp_enab...

I don't usually post non-original content here, but in this case I'll make an exception :) Here's one of the things I've bee...

I was recently stealing anti-XSRF tokens using the CSS design error I found . In the (unnamed for now) app I was exploiting, all the fun hap...

[Or "Logout CSRF" for search indexes; I seem to be addicted to the less common acronym ;-)] Significant? No, of course not. It is ...

Well, here's a nice little gem for the festive season. I like it for a few distinct reasons: It's one of those cases where if you lo...

[Aside: I'm not sure anyone cares, particularly because the "block third party cookies" option tends to break legitimate web s...

I've been meaning to fiddle around with timing attacks for a while. I've had various discussions in the past about the significance ...