Skip to content

Instantly share code, notes, and snippets.

@reconbot

reconbot/toolness security-adventur notes.md

Created February 23, 2014 21:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save reconbot/9177827 to your computer and use it in GitHub Desktop.
Save reconbot/9177827 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
toolness security-adventur notes.md

Thoughts and notes

RegExp Denial of Service

I didn't really learn why this was an issue. Don't allow arbituarily large groups in regexes seems to be the message but since we weren't using the group beforehand the message was sort of lost on me.

Maybe we could rely on the group for some reason and then limit the length of the username to gaurd against this?

Reflected Cross Site Scripting && HttpOnly Cookie

I was confused why two lessons were mixed into one. It took a few read throughs to understand that wasn't the case. I'd have an XSS lesson first.

Now that I solved this one, I see what you're doing... hrm...

CSP

I'd mention it only works on modern browsers upfront

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment