Catching Compromised Cookies - Slack Engineering
Oliver Grubin Sr. Staff Software Engineer, Security Slack uses cookies to track session states for users on slack.com and the Slack Desktop app. The ever-present cookie banners have made cookies mainstream, but as a quick refresher, cookies are a little piece of client-side state associated with a website that is sent up to the web server on every request. Websites use this piece of information to
Exploring the DOMPurify library: Bypasses and Fixes. Tags:Article - Article - Web - mXSS
title: Exploring the DOMPurify library: Bypasses and Fixes date: Nov 17, 2024 tags: Article Web mXSS Exploring the DOMPurify library: Bypasses and Fixes (1/2) 📜 Introduction 🔠How does client-side HTML sanitizer works? â“ Why are mutation XSS (mXSS) possible? â–¶ï¸ DOMPurify 3.1.0 bypass (found by @IceFont 👑) Node flattening HTML Parsing states Proof Of Concept â© DOMPurify 3.1.1 bypass DOMPurify 3.
Next.js App Router ã‚»ã‚ュリティ
Request Header 㧠Next-Action ã‚’é€ä¿¡ã—ã¦ã‚‹ curl ã§å†ç¾ã™ã‚‹ã¨ã“ã‚“ãªæ„Ÿã˜ã® POST 通信 curl 'https://nextclicker.nanabit.dev/' \ -H 'Content-Type: text/plain;charset=UTF-8' \ -H 'Cookie: ...' \ -H 'Next-Action: 6eb8416051487420c0347306825a392adf55f29e' \ --data-raw '[1]' 手動ã§ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’試ã—ã¦ã¿ã‚‹ --data-raw '[9999]' ã®æ•°å€¤ã‚’ã„ã˜ã‚‹ã¨ã€ 1 クリックã§ä¸ŠãŒã‚‹ 数値を変更å¯èƒ½ãªã“ã¨ãŒåˆ†ã‹ã£ãŸ curl 'https://nextclicker.nanabit.dev/' \ -H 'Content-Type: text/plain;charset=UT
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory Description DescriptionOn October 30, 2024, a vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was used to generate the cache key where we hash a combined string of userId + username + password. Under a specific set of conditions, listed below, this co
New crazy payloads in the URL Validation Bypass Cheat Sheet
Published: 29 October 2024 at 13:59 UTC Updated: 29 October 2024 at 14:01 UTC The strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP address calculator, inspired by @e1abrador's Encode IP Burp Suite Extension and many more. New IP validation bypass techniq
New PAT rotation policies preview and optional expiration for fine-grained PATs · GitHub Changelog
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
DOMã®å¤ã„仕組ã¿ã‚’悪用ã—ãŸè„†å¼±æ€§ | フãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰Blog | ミツエーリンクス
pagefindã¯é™çš„サイトã§ã‚‚手軽ã«ã‚µã‚¤ãƒˆå†…検索を実ç¾ã§ãる全文検索ライブラリーã§ã™ã€‚先日ã€pagefindã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã¾ã—ãŸãŒã€DOMã®å¤ã„仕組ã¿ã‚’悪用ã—ãŸã‚‚ã®ã§ã—ãŸã€‚ãã®å†…容を興味深ãæ„Ÿã˜ãŸãŸã‚ã€ã“ã®è¨˜äº‹ã§ç´¹ä»‹ã—ã¾ã™ã€‚ãªãŠã€ç´¹ä»‹ã™ã‚‹æ”»æ’ƒæ‰‹æ³•ã¯DOM Clobberingã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ï¼ˆDOM上書ãã¨ã„ã†æ„味ã§ã™ï¼‰ã€‚ ã“ã®è¨˜äº‹ã§ç´¹ä»‹ã™ã‚‹è„†å¼±æ€§ã¯pagefind 1.1.1ã§ä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚pagefind 1.1.1未満をã”利用ã®ã‹ãŸã¯1.1.1ã«æ›´æ–°ã™ã‚‹ã“ã¨ã‚’ãŠã™ã™ã‚ã—ã¾ã™ã€‚ CVE-2024-45389: DOM clobbering could escalate to XSS æ¦‚è¦ ä¿®æ£å‰ã®pagefindを利用ã—ã¦ã„るサイトã§ã¯ã€ã‚µã‚¤ãƒˆã«HTMLを書ãè¾¼ã‚ã‚‹å ´åˆã€å¤–部ã®JavaScriptã‚’èªã¿è¾¼ã¾ã‚Œã¦ã—ã¾ã†è„†å¼±æ€§ãŒã‚ã‚Šã¾ã—ãŸã€‚書ãè¾¼ã¾ã‚ŒãŸHTMLã«JavaScrip
Secure Node.js Applications from Supply Chain Attacks
Auth0 Marketplace Discover and enable the integrations you need to solve identity Explore Auth0 Marketplace This isn’t another AI-generated blog post about generic security practices. It contains detailed instructions on protecting Node.js applications from supply-chain attacks and describes best practices for security in any programming language. According to the GitHub report, The state of open
Binary Hacks Rebooted
河田 æ—ºã€å°æ± æ‚ ç”Ÿã€æ¸¡é‚‰ 慶一ã€ä½ä¼¯ å¦å“‰ã€è’ç”° 実樹　著ã€éˆ´æœ¨ 創ã€ä¸æ‘ åå²ã€ç«¹è…° é–‹ã€å…‰æˆ 滋生ã€hikaliumã€æµœåœ° 慎一郎　寄稿 TOPICS Programming 発行年月日 2024å¹´08月 PRINT LENGTH 660 ISBN 978-4-8144-0085-0 FORMAT Print PDF EPUB 本書ã¯ä½Žãƒ¬ã‚¤ãƒ¤ã®ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã«é–¢ã™ã‚‹Hack集ã§ã‚ã‚Šã€2006å¹´ã«ç™ºè¡Œã•ã‚ŒãŸã€ŽBinary Hacksã€ã®å†æ§‹ç¯‰ç‰ˆã¨ã—ã¦æ›¸ã‹ã‚Œã¾ã—ãŸã€‚低レイヤã¨ã¯æŠ½è±¡åŒ–ã®åº¦åˆã„ãŒä½Žã計算機ã¨è¿‘ã„レイヤã®ã“ã¨ã‚’指ã—ã€ã¾ãŸHackã¨ã¯å·§å¦™ãªæ–¹æ³•ã§å•é¡Œã‚’解決ã™ã‚‹æ‰‹æ³•ã‚’指ã—ã¾ã™ã€‚ç¾ä»£ã®ã‚³ãƒ³ãƒ”ュータシステムã¯é‡å±¤çš„ã§ã™ã€‚抽象化ã®ãƒ¬ã‚¤ãƒ¤ã‚’é‡ãã‚‹ã“ã¨ã§ç™ºå±•ã—ã€ç„¡æ•°ã®æ©Ÿèƒ½ãŒå®Ÿç¾ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“れらã®ãƒ¬ã‚¤ãƒ¤ã¯å·§ã¿ã«è¨è¨ˆã•ã‚Œã¦ã„ã‚‹ãŸã‚ã€æ©Ÿèƒ½ã‚’利用ã™ã‚‹ã ã‘ãªã‚‰å„レイヤã®å‹•ä½œã‚’詳細ã«çŸ¥ã‚‹å¿…è¦ã¯ã‚ã‚Š
GitHubã§æ‰±ã†Personal access tokenã®åˆ©ç”¨æ–¹æ³•ã‚’ã‚»ã‚ュアã«ã™ã‚‹ - 10X Product Blog
ã“ã‚“ã«ã¡ã¯ã€ã‚»ã‚ュリティãƒãƒ¼ãƒ ã®@sota1235ã§ã™ã€‚ ã‚»ã‚ュリティãƒãƒ¼ãƒ ã§ã¯æ˜¨å¹´ã®å¤é ƒã‹ã‚‰GitHub上ã®ã‚»ã‚ュリティリスクを洗ã„出ã—ã€é †ã«å¯¾å¿œã‚„改善を行ã£ã¦ã„ã¾ã™ã€‚ ãã®ã†ã¡ã®1ã¤ã¨ã—ã¦ã€æ˜¨å¹´ã®ç§‹ã”ã‚ã‹ã‚‰GitHubã®Personal Access Tokenã®å–り扱ã„ã®æ”¹å–„ã‚’è¡Œã£ã¦ãã¾ã—ãŸã€‚ 具体的ã«ã¯ä»¥ä¸‹ã®å–り組ã¿ã‚’è¡Œã„ã¾ã—ãŸã€‚ CIç‰ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹Personal Access Tokenã®åˆ©ç”¨å»ƒæ¢ Organizationã«ãŠã‘ã‚‹Personal Access Token(classic)ã®åˆ©ç”¨ç¦æ¢è¨å®š 今回ã¯ã“ã®2ã¤ã®å–り組ã¿ã«ã¤ã„ã¦ã€ã©ã®ã‚ˆã†ãªèª²é¡Œè¨å®šã‚’è¡Œã„ã€ã©ã‚“ãªæ‰‹é †ã§å®Œäº†ã—ãŸã®ã‹ã‚’ãŠè©±ã—ã—ã¾ã™ã€‚ 以下ã®ã‚ˆã†ãªèª²é¡Œæ„Ÿã€ç–‘å•ã‚’ãŠæŒã¡ã®æ–¹ã«å¯¾ã™ã‚‹1ã¤ã®å›žç”ã«ãªã‚Šã†ã‚‹ã¨æ€ã†ã®ã§è©²å½“ã™ã‚‹æ–¹ã¯ãœã²ã”一èªãã ã•ã„🙠GitHubã«ãŠã‘ã‚‹Personal Access Token
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Retrofitting spatial safety to hundreds of millions of lines of C++
LLMmap: Fingerprinting For Large Language Models
CVE-2024-51757 - GitHub Advisory Database
GitHub - wireghoul/dotdotpwn: DotDotPwn - The Directory Traversal Fuzzer
Passwords shouldn't be limited to 72 characters · Issue #5307 · heartcombo/devise
security: fix DOM clobbering in auto public path by alexander-akait · Pull Request #18700 · webpack/webpack
DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to XSS
ã‚»ã‚ュリティ監視入門
CVE-2024-45047 - GitHub Advisory Database
Secret scanning for non-code GitHub surfaces is now generally available · GitHub Changelog
{{#tags}}- {{label}}
{{/tags}}