Community

Having tried other methods without success and looked through plenty of bloated documentation, this just works! Thank you for providing simple code that does what it's supposed to...

Posted In Git on Snow Leopard.

Mon, 15 Mar 2010 at 14:42:15 GMT

I have problem with this example.

In my php.ini magic_quotes_gpc is off so i'm using only addslashes() in script. Table in MySQL i made with your SQL code and i added one record 'liu' 'kang' :) but anyway $db->query($sql); wan't give me this one record in result...

echo $sql:

SELECT * FROM users WHERE username = '<here is some chinesse sign>' OR username = username /*' AND password = 'guess'

What am i doing wrong?

(sorry for my poor english)

Posted In addslashes() Versus mysql_real_escape_string().

Sun, 14 Mar 2010 at 12:22:02 GMT

Well, I'm not Chris, but I will do my best to address the questions raised in the comments by Ian E and Ray C.

@Ian E - I'm not sure what you found on that first link called "Cool CSRF using nothing but CSS and iframes" because it no longer exists. However, I would venture to guess that if someone indeed did use css + iframes for CSRF it was either one of two things:

1) An example of the possibilities of CSRF against an unprotected form, not one that was using a nonce. From the title, it sounds like it was intended to be an example of the fact you can use only CSS + iframes to execute a CSRF. I do not believe it was meant to be an example of how to use CSS + iframes to bypass a protected form which uses a nonce.

2) If it was indeed an attack against a protected form, not just a vulnerable form, I would be forced to assume it was a particular version of a browser that was vulnerable, not an attack vector meant for all purposes.

I would be forced to assume this because your assumption: "I am no javascript programmer, but I believe javascript can read a frame's content." is incorrect. JavaScript has almost literally NO access to ANY information about a frame. Try it out for yourself, you can get essentially no information about a even a frames current URL, let alone the actual content within the frame - and with good reason.

Imagine how horribly insecure everyone would be if such attacks were possible? Monitoring entered keystrokes inside a frame with JavaScript to steal login credentials, redirecting users from a frame in which they thought they were on a legitimate site to an attack site and etc. If you could use JavaScript to manipulate/grab information from frames, CSRF would be the very least of our problems.

-Ryan

Posted In Security Corner: Cross-Site Request Forgeries.

Thu, 11 Mar 2010 at 20:40:04 GMT

Hi Chris,

I really enjoyed your workshop on the Evolution of Security at Webstock. I think I got enough value from those three hours to justify the entire conference fee. I'm just heading off to Amazon to buy the book. I've been programming in PHP for nearly a decade and was stunned by how little I really knew about security. Thanks for providing the answers.

And thanks for coming to Webstock. It is a great conference, and what's even more amazing is that it's put together by two guys and their wives working part time (they all have full time jobs) and is run by them and a very small group of volunteers. No professional, full-time organisation. Just pure heart.

I hope we'll see you at another Webstock event soon.

Cheers,

Simon

Posted In Webstock.

Sat, 27 Feb 2010 at 11:46:56 GMT

Hi Chris,

I was wondering if you were going to post how Webstock went for you this year.

I live in New Zealand and desperately wanted to get to Wellington but I couldn't get the time of work.

cheers

Robin

Posted In Webstock.

Thu, 25 Feb 2010 at 02:04:18 GMT

I am using the following service for vulnerability research:

http://xss-scanner.com

Posted In Adobe PDF XSS Vulnerability.

Wed, 24 Feb 2010 at 21:01:14 GMT

Hi Chris,

I enjoyed reading this article as well as your article about session security titled "The Truth About Sessions". Gave me deeper insight into how I should be handling sessions in my web apps. Thanks.

Posted In Guru Speak: Storing Sessions in a Database.

Wed, 24 Feb 2010 at 04:10:02 GMT