http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2012-10-10 01:19:24 - theharmonyguy : RT @kellan: We're cranking up the security options on @Etsy, two-factor auth, SSL everywhere, and viewable login history http://tco/t5 http://www.secuobs.com/twitter/news/349399.shtmlhttp://www.secuobs.com/twitter/news/349399.shtml Secuobs.com : 2012-10-09 04:45:02 - theharmonyguy - OK, I'm down to 26 tabs in my main Chrome window That's out of 7 open windows This is actually huge progress for me #modernstickynoteshttp://www.secuobs.com/twitter/news/349183.shtmlhttp://www.secuobs.com/twitter/news/349183.shtml Secuobs.com : 2012-10-03 09:04:11 - theharmonyguy - RT @ErrataRob: SHA1/SHA2/SHA512 are all based on MD4 Kᴇᴄᴄᴀᴋ is not, so any attack on SHA2 is unlikely to work on SHA3 Having both is goodhttp://www.secuobs.com/twitter/news/347817.shtmlhttp://www.secuobs.com/twitter/news/347817.shtml Secuobs.com : 2012-10-01 23:42:28 - theharmonyguy - @insertScript If a filter blacklists javascript:, data: URIs, perhaps blob: could still workhttp://www.secuobs.com/twitter/news/347417.shtmlhttp://www.secuobs.com/twitter/news/347417.shtml Secuobs.com : 2012-09-28 23:55:31 - theharmonyguy - RT @superevr: RT @hasegawayosuke: Bypass IE's XSS Filter by @kinugawamasato http://tco/r3vrusnd nicehttp://www.secuobs.com/twitter/news/346870.shtmlhttp://www.secuobs.com/twitter/news/346870.shtml Secuobs.com : 2012-09-20 20:14:26 - theharmonyguy - RT @scarybeasts: @0x6D6172696F @jeremiahg Ok, $1k of mine too : For max lulz / impact, challenge is: demo Chrome pwn that is _introed_ http://www.secuobs.com/twitter/news/345525.shtmlhttp://www.secuobs.com/twitter/news/345525.shtml Secuobs.com : 2012-09-18 22:24:39 - theharmonyguy - RT @RSnake: Finally got around to donating the XSS cheat sheet to @OWASP http://tco/EI1zI9AK Now everyone can edit/modify at willhttp://www.secuobs.com/twitter/news/344923.shtmlhttp://www.secuobs.com/twitter/news/344923.shtml Secuobs.com : 2012-09-10 11:32:39 - theharmonyguy - @aloria When someone asks me if they should uninstall Java: http://tco/PDOP5p6j #infosecreactionshttp://www.secuobs.com/twitter/news/342523.shtmlhttp://www.secuobs.com/twitter/news/342523.shtml Secuobs.com : 2012-09-10 11:32:39 - theharmonyguy - @aloria How I picture Shmoocon's server when registration starts: http://tco/z9BUfd1n #infosecreactionshttp://www.secuobs.com/twitter/news/342522.shtmlhttp://www.secuobs.com/twitter/news/342522.shtml Secuobs.com : 2012-09-09 11:51:40 - theharmonyguy - @theKos Shmoocon's February 15-17http://www.secuobs.com/twitter/news/342408.shtmlhttp://www.secuobs.com/twitter/news/342408.shtml Secuobs.com : 2012-09-08 18:08:48 - theharmonyguy - @jeremiahg @csoghoian For the record, he's also the Apache Software Foundation's director and an Apache HTTP Server co-founder…http://www.secuobs.com/twitter/news/342297.shtmlhttp://www.secuobs.com/twitter/news/342297.shtml Secuobs.com : 2012-09-07 21:22:52 - theharmonyguy - All of this suggests that the actual story of razors-and-blades is more complicated more interesting PDF http://tco/MeDy9rqe via @jen_hhttp://www.secuobs.com/twitter/news/342057.shtmlhttp://www.secuobs.com/twitter/news/342057.shtml Secuobs.com : 2012-09-06 21:52:16 - theharmonyguy - RT @DennisF: New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions Research from @julianor http://tco/TvxhztyRhttp://www.secuobs.com/twitter/news/341593.shtmlhttp://www.secuobs.com/twitter/news/341593.shtml Secuobs.com : 2012-09-06 21:52:16 - theharmonyguy - Just caught up on Amazon's announcements from today; pretty impressive But they'd better be working on at least an Apple TV competitor toohttp://www.secuobs.com/twitter/news/341592.shtmlhttp://www.secuobs.com/twitter/news/341592.shtml Secuobs.com : 2012-09-06 21:52:16 - theharmonyguy - Apple and Amazon are both offering competing ecosystems Right now, Apple's integrates in more places due to Apple TV, iPhone, etchttp://www.secuobs.com/twitter/news/341591.shtmlhttp://www.secuobs.com/twitter/news/341591.shtml Secuobs.com : 2012-08-20 12:36:50 - theharmonyguy - @randomdross Time to start watching for Natural keyboards during 0-day demos ;http://www.secuobs.com/twitter/news/340491.shtmlhttp://www.secuobs.com/twitter/news/340491.shtml Secuobs.com : 2012-08-20 12:36:50 - theharmonyguy - @random_walker I loved how it started with 0-day in your brain, then you read they had 10-40 pourcents chance of success Still, interesting workhttp://www.secuobs.com/twitter/news/340490.shtmlhttp://www.secuobs.com/twitter/news/340490.shtml Secuobs.com : 2012-08-10 12:11:29 - theharmonyguy - If you come across any Facebook phishing sites, you can now report them via phish at http://tco/iUOxw9Lb: https://tco/jh1pko8Fhttp://www.secuobs.com/twitter/news/339411.shtmlhttp://www.secuobs.com/twitter/news/339411.shtml Secuobs.com : 2012-08-09 11:28:33 - theharmonyguy - RT @justinschuh: After two and a half years of work, we finally have Flash in the full Chrome sandbox on all versions of Windows: http:/ http://www.secuobs.com/twitter/news/339183.shtmlhttp://www.secuobs.com/twitter/news/339183.shtml Secuobs.com : 2012-08-08 11:09:11 - theharmonyguy - @angelofsecurity If you scroll down to April 2011 here, you'll find slides to an XSS presentation I once did: https://tco/7EDnlPWmhttp://www.secuobs.com/twitter/news/338972.shtmlhttp://www.secuobs.com/twitter/news/338972.shtml Secuobs.com : 2012-07-31 06:05:57 - theharmonyguy - @securityninja @jeremiahg But wasn't clear why it came up now And I said we'd talk about white-hat listing after I got back from Defconhttp://www.secuobs.com/twitter/news/337084.shtmlhttp://www.secuobs.com/twitter/news/337084.shtml Secuobs.com : 2012-07-27 03:04:44 - theharmonyguy - Yay, I'm actually #1 in a @garethheyes XSS challenge http://tco/HYs1ynsC But probably won't last Going to try and get some sleep now :http://www.secuobs.com/twitter/news/336221.shtmlhttp://www.secuobs.com/twitter/news/336221.shtml Secuobs.com : 2012-07-27 03:04:44 - theharmonyguy - RT @garethheyes: Did a write up on the #xss #challenge2 http://tco/nCpf5IN1 xss multi context injection contest well done @insertScripthttp://www.secuobs.com/twitter/news/336220.shtmlhttp://www.secuobs.com/twitter/news/336220.shtml Secuobs.com : 2012-07-27 03:04:44 - theharmonyguy - Landed in Vegas Defcon, here I comehttp://www.secuobs.com/twitter/news/336219.shtmlhttp://www.secuobs.com/twitter/news/336219.shtml Secuobs.com : 2012-07-21 11:57:47 - theharmonyguy - RT @ashk4n: You don't always need a face to identify someone in a photo/video: FBI To Add Tattoos To Biometric ID Capabilities http://t http://www.secuobs.com/twitter/news/335210.shtmlhttp://www.secuobs.com/twitter/news/335210.shtml Secuobs.com : 2012-07-21 11:57:47 - theharmonyguy - YES RT @verge: Apple adds 20th Century Fox movies to iTunes in the Cloud, all major studios now on board http://tco/KiiP8Ld2http://www.secuobs.com/twitter/news/335209.shtmlhttp://www.secuobs.com/twitter/news/335209.shtml Secuobs.com : 2012-07-21 11:57:47 - theharmonyguy - @scalzi There's a Call Me Maybe spoof in there somewhere…http://www.secuobs.com/twitter/news/335208.shtmlhttp://www.secuobs.com/twitter/news/335208.shtml Secuobs.com : 2012-07-19 06:02:51 - theharmonyguy - RT @krvw: First draft of my OWASP Cheat Sheet for iOS App Developers is available at https://tco/PuzyJIOA Enjoyhttp://www.secuobs.com/twitter/news/334523.shtmlhttp://www.secuobs.com/twitter/news/334523.shtml Secuobs.com : 2012-07-16 04:21:40 - theharmonyguy - RT @flyosity: Apple backtracks on EPEAT standards, Bob Mansfield pens an apology and explanation http://tco/kb3IEisthttp://www.secuobs.com/twitter/news/333428.shtmlhttp://www.secuobs.com/twitter/news/333428.shtml Secuobs.com : 2012-07-13 18:51:37 - theharmonyguy - RT @dakami: “@starien: @mikko q: How is JavaScript different from Java a: …how is hamster different from ham” A hamster can runhttp://www.secuobs.com/twitter/news/333082.shtmlhttp://www.secuobs.com/twitter/news/333082.shtml Secuobs.com : 2012-07-07 17:41:40 - theharmonyguy - btw, don't think I'd mentioned this yet: I'll be at Defcon this yearhttp://www.secuobs.com/twitter/news/332309.shtmlhttp://www.secuobs.com/twitter/news/332309.shtml Secuobs.com : 2012-07-07 17:41:40 - theharmonyguy - RT @matt_presson: RT @LightOS @_websec: We are proud to present The SQL Injection KB http://tco/02JOhIKH by @LightOS #SQLi #Cheatsheet http://www.secuobs.com/twitter/news/332308.shtmlhttp://www.secuobs.com/twitter/news/332308.shtml Secuobs.com : 2012-07-07 17:41:40 - theharmonyguy - RT @garethheyes: RT @0x6D6172696F: A new DOM protection lib in the vein of XSSMe and XSSMe² has gone prototype-level today Working in http://www.secuobs.com/twitter/news/332307.shtmlhttp://www.secuobs.com/twitter/news/332307.shtml Secuobs.com : 2012-07-07 17:41:40 - theharmonyguy - @malliegator Given how people use the term social engineering, that may not be the best description to use for that article… :http://www.secuobs.com/twitter/news/332306.shtmlhttp://www.secuobs.com/twitter/news/332306.shtml Secuobs.com : 2012-06-30 02:31:34 - theharmonyguy - @random_walker Per-track/album download - iTunes Stores, AmazonMP3, Bandcamp, etchttp://www.secuobs.com/twitter/news/331116.shtmlhttp://www.secuobs.com/twitter/news/331116.shtml Secuobs.com : 2012-06-25 07:43:16 - theharmonyguy - RT @johnwilander: XSS advisory from 2000: Malicious HTML Tags Embedded in Client Web Requests Systems affected: Web browsers se http://www.secuobs.com/twitter/news/330021.shtmlhttp://www.secuobs.com/twitter/news/330021.shtml Secuobs.com : 2012-06-25 07:43:16 - theharmonyguy - Really interesting tricks here: Bypassing ASLR and DEP on Adobe Reader X http://tco/mRfffhuAhttp://www.secuobs.com/twitter/news/330020.shtmlhttp://www.secuobs.com/twitter/news/330020.shtml Secuobs.com : 2012-06-25 07:43:16 - theharmonyguy - So @0x6D6172696F has another XSS challenge up And it's driving me crazy http://tco/u7IKq61I #tryingtoavoididhttp://www.secuobs.com/twitter/news/330019.shtmlhttp://www.secuobs.com/twitter/news/330019.shtml Secuobs.com : 2012-06-22 08:05:23 - theharmonyguy - RT @jeremiahg: DOM XSS found on Etsy Between the time the researchers finds it has a chance to disclose, it gets fixed http://t http://www.secuobs.com/twitter/news/329257.shtmlhttp://www.secuobs.com/twitter/news/329257.shtml Secuobs.com : 2012-06-22 08:05:23 - theharmonyguy - RT @securityninja: RT @CNNMoneyTech: Not a hack or DDoS attack @twittercomms: Today's outage is due to a cascaded bug in one of our infr http://www.secuobs.com/twitter/news/329256.shtmlhttp://www.secuobs.com/twitter/news/329256.shtml Secuobs.com : 2012-06-15 07:34:33 - theharmonyguy - RT @ericlaw: How'd IE10's JavaScript engine get so much faster Lots of work http://tco/OQtCNWevhttp://www.secuobs.com/twitter/news/327614.shtmlhttp://www.secuobs.com/twitter/news/327614.shtml Secuobs.com : 2012-06-12 13:03:04 - theharmonyguy - @scarybeasts Can I just note to someone on Chrome team that I find shifting Recently Closed to put Web Store in the corner annoying :http://www.secuobs.com/twitter/news/326885.shtmlhttp://www.secuobs.com/twitter/news/326885.shtml Secuobs.com : 2012-06-12 13:03:04 - theharmonyguy - RT @trailofbits: We have published our initial analysis of Flame's MD5 collision capabilities http://tco/rsvSp6udhttp://www.secuobs.com/twitter/news/326884.shtmlhttp://www.secuobs.com/twitter/news/326884.shtml Secuobs.com : 2012-06-12 13:03:04 - theharmonyguy - RT @totally_unknown: 3x XSS in Google Gmail are fixed and here's the summary http://tco/LOLrUV11http://www.secuobs.com/twitter/news/326883.shtmlhttp://www.secuobs.com/twitter/news/326883.shtml Secuobs.com : 2012-06-09 01:42:11 - theharmonyguy - Wait, the top story on Techmeme is that MD5 is no longer considered safehttp://www.secuobs.com/twitter/news/326214.shtmlhttp://www.secuobs.com/twitter/news/326214.shtml Secuobs.com : 2012-06-09 01:42:11 - theharmonyguy - RT @cjoh: Want to play a fun prank on the Internet Release a billion line file w/random md5 hashes Claim it's facebook passwords Wr http://www.secuobs.com/twitter/news/326213.shtmlhttp://www.secuobs.com/twitter/news/326213.shtml Secuobs.com : 2012-06-06 06:46:39 - theharmonyguy - RT @arbornetworks: Facebook now notifying DNSChanger victims via their pages Hooray https://tco/FuegJ0jjhttp://www.secuobs.com/twitter/news/325529.shtmlhttp://www.secuobs.com/twitter/news/325529.shtml Secuobs.com : 2012-06-06 06:46:39 - theharmonyguy - If you're interested in stopping XSS, you should read this RT @garethheyes Finally a comprehensive write up on #JSLR http://tco/whRRIzrJhttp://www.secuobs.com/twitter/news/325528.shtmlhttp://www.secuobs.com/twitter/news/325528.shtml Secuobs.com : 2012-06-04 03:37:04 - theharmonyguy - RT @jeremiahg: CloudFlare hacked, they share details http://tco/AQPlB0Ji -- UGNazi disagree w/ scale of scope of their analysis http:// http://www.secuobs.com/twitter/news/325254.shtmlhttp://www.secuobs.com/twitter/news/325254.shtml Secuobs.com : 2012-06-04 03:37:04 - theharmonyguy - RT @cschweitz: This is AWESOME: Engineering Students Design Non-Stick Ketchup Bottle http://tco/kew3FHFf Could save $15M in wasted http://www.secuobs.com/twitter/news/325253.shtmlhttp://www.secuobs.com/twitter/news/325253.shtml Secuobs.com : 2012-06-01 05:36:20 - theharmonyguy - RT @kkotowicz: Gratz to Dr Mario Heiderich @0x6D6172696F Towards Elimination of XSS Attacksw/ a Trusted Capability Ctrl-edDOM http://www.secuobs.com/twitter/news/324727.shtmlhttp://www.secuobs.com/twitter/news/324727.shtml Secuobs.com : 2012-06-01 05:36:20 - theharmonyguy - RT @dinodaizovi: Apple has released their whitepaper on iOS security for businesses and enterprises: http://tco/JedvdiQthttp://www.secuobs.com/twitter/news/324726.shtmlhttp://www.secuobs.com/twitter/news/324726.shtml Secuobs.com : 2012-06-01 05:36:20 - theharmonyguy - RT @securityninja: RT @curphey: SQL Injection Vulnerability in Ruby on Rails CVE-2012-2661 http://tco/2On4E6nk boomhttp://www.secuobs.com/twitter/news/324725.shtmlhttp://www.secuobs.com/twitter/news/324725.shtml Secuobs.com : 2012-05-30 07:51:43 - theharmonyguy - Finally saw The Avengers Nerd check: Anyone else notice a Sun Oracle logo think Surely Java's reactor clause bars dark energy tests :http://www.secuobs.com/twitter/news/324234.shtmlhttp://www.secuobs.com/twitter/news/324234.shtml Secuobs.com : 2012-05-30 07:51:43 - theharmonyguy - RT @blowdart: If you can write #metro apps in html5 and javascript and now there's clippy for #jquery METRO APPS WITH CLIPPY http: http://www.secuobs.com/twitter/news/324233.shtmlhttp://www.secuobs.com/twitter/news/324233.shtml Secuobs.com : 2012-05-30 07:51:43 - theharmonyguy - New fingerprinting technique: render WebGL + fonts with HTML5 canvas, then check output pixels PDF: http://tco/6zb7iYxUhttp://www.secuobs.com/twitter/news/324232.shtmlhttp://www.secuobs.com/twitter/news/324232.shtml Secuobs.com : 2012-05-21 17:11:33 - theharmonyguy - OK I'm worried now : RT @kkotowicz cool new ideas popping up after meeting @theKos Chrome users, take care in the future :http://www.secuobs.com/twitter/news/322002.shtmlhttp://www.secuobs.com/twitter/news/322002.shtml Secuobs.com : 2012-05-17 05:19:44 - theharmonyguy - @vogon Perhaps - I'm using Chrome with a Flash-blocking extension; sidebar wouldn't load until I turned it off or added an exceptionhttp://www.secuobs.com/twitter/news/321120.shtmlhttp://www.secuobs.com/twitter/news/321120.shtml Secuobs.com : 2012-05-10 07:41:05 - theharmonyguy - RT @aplusbi: I'm refractoring my cloud-based heroku django social media geo-located app to HTML9 http://tco/fw0n7icthttp://www.secuobs.com/twitter/news/319353.shtmlhttp://www.secuobs.com/twitter/news/319353.shtml Secuobs.com : 2012-05-02 09:04:04 - theharmonyguy - @micahcrenwelge You'll want to disable Java and any other unnecessary plug-ins, then keep all other plug-ins and software up-to-datehttp://www.secuobs.com/twitter/news/317253.shtmlhttp://www.secuobs.com/twitter/news/317253.shtml Secuobs.com : 2012-04-20 05:56:43 - theharmonyguy - RT @flyosity: Random colors generated by measuring the real-time quantum fluctuations of a vacuum in a lab in Australia http://tco/Qjc http://www.secuobs.com/twitter/news/314054.shtmlhttp://www.secuobs.com/twitter/news/314054.shtml Secuobs.com : 2012-04-13 04:53:45 - theharmonyguy - RT @superevr: Exploiting XSS in Ajax Web Applications https://tco/V8K9maJThttp://www.secuobs.com/twitter/news/312073.shtmlhttp://www.secuobs.com/twitter/news/312073.shtml Secuobs.com : 2012-04-11 06:18:10 - theharmonyguy - Cleaning old files; found a Dec 2010 txt with what looked like XSS vectors for popular site and they still work Guess I need to reporthttp://www.secuobs.com/twitter/news/311237.shtmlhttp://www.secuobs.com/twitter/news/311237.shtml Secuobs.com : 2012-04-07 00:15:03 - theharmonyguy - A positive take on selling zero-day exploits eg VUPEN: https://tco/oORDj2Qt via @shawnmoyerhttp://www.secuobs.com/twitter/news/310132.shtmlhttp://www.secuobs.com/twitter/news/310132.shtml Secuobs.com : 2012-04-07 00:15:03 - theharmonyguy - In case you missed it Facebook runs on a single 15GB executable updated via BitTorrent other engineering tales: http://tco/IfTRVF4khttp://www.secuobs.com/twitter/news/310131.shtmlhttp://www.secuobs.com/twitter/news/310131.shtml Secuobs.com : 2012-04-06 13:20:29 - theharmonyguy - RT @ashk4n: requisite spoof version of Google Glass project: ADmented reality http://tco/RTthWZHX via @joebeone #there_i_fixed_ithttp://www.secuobs.com/twitter/news/309939.shtmlhttp://www.secuobs.com/twitter/news/309939.shtml Secuobs.com : 2012-04-05 15:58:59 - theharmonyguy - RT @shanselman: HTTPS SSL doesn't mean trust this It means this is private You may be having a private conversation with Satanhttp://www.secuobs.com/twitter/news/309648.shtmlhttp://www.secuobs.com/twitter/news/309648.shtml Secuobs.com : 2012-03-28 11:52:05 - theharmonyguy - RT @kkotowicz: Chrome addons hacking: Bye Bye AdBlock filters http://tco/sG3ZNTyVhttp://www.secuobs.com/twitter/news/307281.shtmlhttp://www.secuobs.com/twitter/news/307281.shtml Secuobs.com : 2012-03-22 20:09:17 - theharmonyguy - So reportedly PayPal had XSS in their search box: http://tco/CUHopqMl via @securityshellhttp://www.secuobs.com/twitter/news/305775.shtmlhttp://www.secuobs.com/twitter/news/305775.shtml Secuobs.com : 2012-03-20 02:07:38 - theharmonyguy - Pinterest search of best buy gift cards seems to confirm RT @jeremiahg Reports of an XSS attack targeting Pinterest http://tco/yItqOGiZhttp://www.secuobs.com/twitter/news/304894.shtmlhttp://www.secuobs.com/twitter/news/304894.shtml Secuobs.com : 2012-03-20 02:07:38 - theharmonyguy - Pinterest appears to have already deleted the pin with XSS payload and the user account that posted it Attack could have done much morehttp://www.secuobs.com/twitter/news/304893.shtmlhttp://www.secuobs.com/twitter/news/304893.shtml Secuobs.com : 2012-03-20 02:07:38 - theharmonyguy - @biosshadow @jeremiahg If the post were still accessible, the payload actually removes links for reporting or removinghttp://www.secuobs.com/twitter/news/304892.shtmlhttp://www.secuobs.com/twitter/news/304892.shtml Secuobs.com : 2012-03-16 11:58:14 - theharmonyguy - @garethheyes So you're saying an injected payload could potentially control the location object and use that to persisthttp://www.secuobs.com/twitter/news/303990.shtmlhttp://www.secuobs.com/twitter/news/303990.shtml Secuobs.com : 2012-03-15 19:41:31 - theharmonyguy - RT @p01: JS1K Speech Synthesis - http://tco/c9Jg8FpA - Speaks as you type and whole sentences in 1K of JavaScript #spoiler #formant #sy http://www.secuobs.com/twitter/news/303834.shtmlhttp://www.secuobs.com/twitter/news/303834.shtml Secuobs.com : 2012-03-08 03:47:03 - theharmonyguy - RT @securityshell: Sergey Glazunov -Full Chrome Pwn win $60,000 https://tco/ezt0SIi8http://www.secuobs.com/twitter/news/301085.shtmlhttp://www.secuobs.com/twitter/news/301085.shtml Secuobs.com : 2012-03-01 00:25:53 - theharmonyguy - RT @theKos: This is a great SQL Injection resource http://tco/Qn9pOSvChttp://www.secuobs.com/twitter/news/298896.shtmlhttp://www.secuobs.com/twitter/news/298896.shtml Secuobs.com : 2012-02-28 22:13:14 - theharmonyguy - @securityshell lol, haven't been checking for XSS, just using it for searcheshttp://www.secuobs.com/twitter/news/298392.shtmlhttp://www.secuobs.com/twitter/news/298392.shtml Secuobs.com : 2012-02-24 05:57:47 - theharmonyguy - RT @PascalVanHecke: http://tco/g98KYwLm encrypts yr files BEFORE you trust them to a cloud service Dropbox/SkyDrive/BoxDotNet/GoogleDr http://www.secuobs.com/twitter/news/297077.shtmlhttp://www.secuobs.com/twitter/news/297077.shtml Secuobs.com : 2012-02-22 06:12:37 - theharmonyguy - Plug-in security more than just Flash/Java: RT @kkotowicz Chrome addons hacking: want XSS on http://tco/wmp3ZiRp http://tco/mqjb0nMhhttp://www.secuobs.com/twitter/news/296209.shtmlhttp://www.secuobs.com/twitter/news/296209.shtml Secuobs.com : 2012-02-19 20:48:38 - theharmonyguy - @dakami XSS in the City, with sequel XSS in the City: alert2 #nerdflixhttp://www.secuobs.com/twitter/news/295697.shtmlhttp://www.secuobs.com/twitter/news/295697.shtml Secuobs.com : 2012-02-18 10:26:01 - theharmonyguy - RT @jeremiahg: If you're into Advanced Oracle SQL Injection, this post is required reading: http://tco/vVHi8PFf @WhiteHatSec TRC http://www.secuobs.com/twitter/news/295465.shtmlhttp://www.secuobs.com/twitter/news/295465.shtml Secuobs.com : 2012-02-18 10:26:01 - theharmonyguy - @jeremiahg Nice I could have used that on an app last year : Reminds me of another fun blind SQLi where I got pw hashes 1 char at a timehttp://www.secuobs.com/twitter/news/295464.shtmlhttp://www.secuobs.com/twitter/news/295464.shtml Secuobs.com : 2012-02-17 20:50:31 - theharmonyguy - RT @kkotowicz: Intro to Chrome addons hacking: fingerprinting I know what addons you use http://tco/lO0Wj4JPhttp://www.secuobs.com/twitter/news/295233.shtmlhttp://www.secuobs.com/twitter/news/295233.shtml Secuobs.com : 2012-02-16 21:27:38 - theharmonyguy - RT @joedevon: WOW That OWASP cheatsheet list I just RT'ed is the motherlode They even have a REST security cheatsheet BOOKMARKED http http://www.secuobs.com/twitter/news/294802.shtmlhttp://www.secuobs.com/twitter/news/294802.shtml Secuobs.com : 2012-02-16 06:36:01 - theharmonyguy - RT @jeremiahg: Adobe patches Flash amidst report of a universal xss “is being exploited in the wild in active targeted attacks” http http://www.secuobs.com/twitter/news/294582.shtmlhttp://www.secuobs.com/twitter/news/294582.shtml Secuobs.com : 2012-02-16 01:05:01 - theharmonyguy - RT @sdw: I was convinced  product shots were 3D, but apparently some are photos with insane focus stacking: http://tco/QhEgjzU1 /via @ http://www.secuobs.com/twitter/news/294451.shtmlhttp://www.secuobs.com/twitter/news/294451.shtml Secuobs.com : 2012-02-15 19:20:11 - theharmonyguy - @vogon Chrome It's by GeoIP, I assume - it's not using the geolocation feature with the UI prompt Just auto-filling Washington DChttp://www.secuobs.com/twitter/news/294256.shtmlhttp://www.secuobs.com/twitter/news/294256.shtml Secuobs.com : 2012-02-12 01:40:21 - theharmonyguy - RT @kkotowicz: “@0x6D6172696F: Not too well-known yet not so uncommon XSS technique where HTML entities won't protect you http://tco/t7 http://www.secuobs.com/twitter/news/293221.shtmlhttp://www.secuobs.com/twitter/news/293221.shtml Secuobs.com : 2012-02-09 19:10:01 - theharmonyguy - @manicode Yeah, if I remember right, it grew out of this XSS challenge: http://tco/ff7R0C1j Theory was if XSS could be solved in the DOMhttp://www.secuobs.com/twitter/news/292471.shtmlhttp://www.secuobs.com/twitter/news/292471.shtml Secuobs.com : 2012-02-09 19:10:01 - theharmonyguy - RT @WisecWisec: I can still see your actions on Google Maps over SSL http://tco/V5KEoyLL via @cesarcer //LOLTerrifichttp://www.secuobs.com/twitter/news/292470.shtmlhttp://www.secuobs.com/twitter/news/292470.shtml Secuobs.com : 2012-02-09 02:05:22 - theharmonyguy - RT @securityshell: Creating Backdoors Using SQL Injection http://tco/ClHjiQO0http://www.secuobs.com/twitter/news/292255.shtmlhttp://www.secuobs.com/twitter/news/292255.shtml Secuobs.com : 2012-02-09 02:05:22 - theharmonyguy - So, who's going to be first to setup a proxy and start checking a bunch of popular iOS apps for address book uploadshttp://www.secuobs.com/twitter/news/292254.shtmlhttp://www.secuobs.com/twitter/news/292254.shtml Secuobs.com : 2012-02-08 22:14:00 - theharmonyguy - RT @jeremiahg: New Blog Post: A Single-Site Browser’s impact on XSS, CSRF, and Clickjacking http://tco/5kzFnIxb Cc: @ma1 @theharmonyguyhttp://www.secuobs.com/twitter/news/292144.shtmlhttp://www.secuobs.com/twitter/news/292144.shtml Secuobs.com : 2012-02-08 03:00:06 - theharmonyguy - @randomdross @jeremiahg @secureideas The Skype for iOS XSS also demonstrates another avenue for XSS in single-site/mobile appshttp://www.secuobs.com/twitter/news/291799.shtmlhttp://www.secuobs.com/twitter/news/291799.shtml Secuobs.com : 2012-02-08 03:00:06 - theharmonyguy - @secureideas @jeremiahg How would they limit exfiltration If XSS can load in a DOM it can talk to external resources, righthttp://www.secuobs.com/twitter/news/291798.shtmlhttp://www.secuobs.com/twitter/news/291798.shtml Secuobs.com : 2012-02-07 00:46:53 - theharmonyguy - RT @randomdross: RT @mathias: The Eval that Men Do — a large-scale study of the use of `eval` in JavaScript apps: http://tco/MwWAXlWJ http://www.secuobs.com/twitter/news/291354.shtmlhttp://www.secuobs.com/twitter/news/291354.shtml Secuobs.com : 2012-02-07 00:46:53 - theharmonyguy - As Open Graph apps grow and given Facebook's anti-clickjacking code, I wonder if scammers/attackers will shift more to CSRF/CJ against appshttp://www.secuobs.com/twitter/news/291353.shtmlhttp://www.secuobs.com/twitter/news/291353.shtml Secuobs.com : 2012-02-04 03:14:36 - theharmonyguy - RT @mubix: {blog} A @textfiles approach at gathering the world's DNS - Slides http://tco/96EiAScuhttp://www.secuobs.com/twitter/news/290670.shtmlhttp://www.secuobs.com/twitter/news/290670.shtml Secuobs.com : 2012-02-03 02:04:01 - theharmonyguy - In case you missed it yesterday What you should know before caching JavaScript in HTML5 localStorage: http://tco/4vcvUvXs #XSShttp://www.secuobs.com/twitter/news/290297.shtmlhttp://www.secuobs.com/twitter/news/290297.shtml Secuobs.com : 2012-02-01 03:27:04 - theharmonyguy - RT @manicode: I have a @whitehatsec webinar on Feb 8th regarding new research on XSS defense https://tco/wKPcLVqjhttp://www.secuobs.com/twitter/news/289721.shtmlhttp://www.secuobs.com/twitter/news/289721.shtml Secuobs.com : 2012-01-31 21:24:09 - theharmonyguy - RT @jeremiahg: Apache httpOnly Cookie Disclosure http://tco/EaJoK1Ca cleverhttp://www.secuobs.com/twitter/news/289547.shtmlhttp://www.secuobs.com/twitter/news/289547.shtml Secuobs.com : 2012-01-26 19:36:40 - theharmonyguy - RT @theKos: I have one shmoocon ticket available, first person to tell me they want it gets buys it Also, will trade for 0dayhttp://www.secuobs.com/twitter/news/287959.shtmlhttp://www.secuobs.com/twitter/news/287959.shtml Secuobs.com : 2012-01-26 00:00:10 - theharmonyguy - RT @securityshell: SQL Backdoors howto with Wordpress PHPBB3 Examples: http://tco/SyfOkhko @BlackhatStaff http://www.secuobs.com/twitter/news/287624.shtmlhttp://www.secuobs.com/twitter/news/287624.shtml Secuobs.com : 2012-01-25 00:29:53 - theharmonyguy - I want to start a really slow ad network on http://tco/XbMeTpz8 so when sites load in Chrome I'll see Waiting for http://tco/XbMeTpz8http://www.secuobs.com/twitter/news/287230.shtmlhttp://www.secuobs.com/twitter/news/287230.shtml Secuobs.com : 2012-01-21 00:44:26 - theharmonyguy - Or if it makes sense to you : RT @yoz If you find yourself laughing harder at the Javascript output YOU ARE A NERD https://tco/e7k6D7FWhttp://www.secuobs.com/twitter/news/286020.shtmlhttp://www.secuobs.com/twitter/news/286020.shtml Secuobs.com : 2012-01-21 00:44:26 - theharmonyguy - RT @WeldPond: What Happens To Your Files When a Cloud Service Shuts Down XDA-Developers has 200K links to #megaupload http://tco/JGssJlUthttp://www.secuobs.com/twitter/news/286019.shtmlhttp://www.secuobs.com/twitter/news/286019.shtml Secuobs.com : 2012-01-17 23:09:15 - theharmonyguy - RT @pedramamini: littleblackbox, a database of private SSL/SSH keys for embedded devices: https://tco/ulFwiTcEhttp://www.secuobs.com/twitter/news/284795.shtmlhttp://www.secuobs.com/twitter/news/284795.shtml Secuobs.com : 2012-01-17 01:25:58 - theharmonyguy - That site in my last RT also has an excellent, thorough article on the logic behind XSS and it's from 2008: http://tco/ZDqSHdzkhttp://www.secuobs.com/twitter/news/284442.shtmlhttp://www.secuobs.com/twitter/news/284442.shtml Secuobs.com : 2012-01-13 01:02:53 - theharmonyguy - RT @skeptic_fx: Adobe Flash Webcam clickjacking - The security fix that wasn't and the hole that was http://tco/foRTQViahttp://www.secuobs.com/twitter/news/283243.shtmlhttp://www.secuobs.com/twitter/news/283243.shtml Secuobs.com : 2012-01-13 01:02:53 - theharmonyguy - RT @securityninja: RT @packetwerks: This is how you know to use another register PCI wut http://tco/wzVuPXkJhttp://www.secuobs.com/twitter/news/283242.shtmlhttp://www.secuobs.com/twitter/news/283242.shtml Secuobs.com : 2012-01-13 01:02:53 - theharmonyguy - RT @johnwilander: JSZip - Create zip files with JavaScript Why Good for file uploads http://tco/igkGB5lF via @jerome_etienne @mrdoob http://www.secuobs.com/twitter/news/283241.shtmlhttp://www.secuobs.com/twitter/news/283241.shtml Secuobs.com : 2012-01-11 05:24:27 - theharmonyguy - @jeremiahg @manicode With so many other issues, has CSRF really been needed much in actual attackshttp://www.secuobs.com/twitter/news/282561.shtmlhttp://www.secuobs.com/twitter/news/282561.shtml Secuobs.com : 2012-01-11 05:24:27 - theharmonyguy - How have I not seen this before Lenovo USB hard drive with built-in AES256 and keypad for 8- to 16-character password: http://tco/abvN67sJhttp://www.secuobs.com/twitter/news/282560.shtmlhttp://www.secuobs.com/twitter/news/282560.shtml Secuobs.com : 2012-01-11 05:24:27 - theharmonyguy - @mattjay @jeremiahg @manicode I suppose that gets back to definitions - if you're using XSS to launch, is it really a CSRF attackhttp://www.secuobs.com/twitter/news/282559.shtmlhttp://www.secuobs.com/twitter/news/282559.shtml Secuobs.com : 2012-01-10 18:54:23 - theharmonyguy - @jeremiahg @skeptic_fx My concern would be more XSS on site with permissions UI implementation seems to avoid clickjackinghttp://www.secuobs.com/twitter/news/282397.shtmlhttp://www.secuobs.com/twitter/news/282397.shtml Secuobs.com : 2012-01-10 01:45:47 - theharmonyguy - RT @digdns: DNS-blocking explained in a simple picture http://tco/PT7E6o4Rhttp://www.secuobs.com/twitter/news/282225.shtmlhttp://www.secuobs.com/twitter/news/282225.shtml Secuobs.com : 2012-01-10 01:45:47 - theharmonyguy - @mckt_ @matthewhughes To the cloudhttp://www.secuobs.com/twitter/news/282224.shtmlhttp://www.secuobs.com/twitter/news/282224.shtml Secuobs.com : 2012-01-09 22:03:02 - theharmonyguy - ATT mHealth Alpha - consumers can have single cloud aggregate health data from doctor offices insurance companies Wait, whathttp://www.secuobs.com/twitter/news/282110.shtmlhttp://www.secuobs.com/twitter/news/282110.shtml Secuobs.com : 2012-01-09 22:03:02 - theharmonyguy - Antichrist, meet SQL injection Actual quote from a conversation involving eschatologyhttp://www.secuobs.com/twitter/news/282109.shtmlhttp://www.secuobs.com/twitter/news/282109.shtml Secuobs.com : 2012-01-07 03:45:53 - theharmonyguy - @kkotowicz @0x6D6172696F @theKos @mattjay So remember that HTML5-related XSS I mentioned It's gotten worse Mind if I email y'all about ithttp://www.secuobs.com/twitter/news/281391.shtmlhttp://www.secuobs.com/twitter/news/281391.shtml Secuobs.com : 2012-01-05 22:50:03 - theharmonyguy - Remember, XSS is not just about scripting By @0x6D6172696F: RT @jeremiahg browser keystroke logger w/o javascript: http://tco/JTzFSYrnhttp://www.secuobs.com/twitter/news/281024.shtmlhttp://www.secuobs.com/twitter/news/281024.shtml Secuobs.com : 2011-12-23 20:36:05 - theharmonyguy - Also, on Facebook as a proxy - would you really want to use a proxy that requires you to be logged in with Facebook credentialshttp://www.secuobs.com/twitter/news/277921.shtmlhttp://www.secuobs.com/twitter/news/277921.shtml Secuobs.com : 2011-12-23 20:36:05 - theharmonyguy - @IHTeam But why use it for SQLi or crawling if Facebook can track all of your requests and tie them to your accounthttp://www.secuobs.com/twitter/news/277920.shtmlhttp://www.secuobs.com/twitter/news/277920.shtml Secuobs.com : 2011-12-23 20:36:05 - theharmonyguy - @0x6D6172696F Hang on, you can regexp a URL and apply CSS rules based on that More potential for scriptless XSS therehttp://www.secuobs.com/twitter/news/277919.shtmlhttp://www.secuobs.com/twitter/news/277919.shtml Secuobs.com : 2011-12-23 20:36:05 - theharmonyguy - @shreeraj Hey, on CORjacking - isn't XSS still required to pull this off I'm not really seeing what's new herehttp://www.secuobs.com/twitter/news/277918.shtmlhttp://www.secuobs.com/twitter/news/277918.shtml Secuobs.com : 2011-12-22 20:58:40 - theharmonyguy - RT @osxreverser: Microsoft that indicates that the company is adding JavaScript and HTML5 support to Office MORE HOLES o/ http://www.secuobs.com/twitter/news/277596.shtmlhttp://www.secuobs.com/twitter/news/277596.shtml Secuobs.com : 2011-12-21 23:48:23 - theharmonyguy - RT @jeresig: New Blog Post: JavaScript as a First Language: http://tco/kjyucBkNhttp://www.secuobs.com/twitter/news/277353.shtmlhttp://www.secuobs.com/twitter/news/277353.shtml Secuobs.com : 2011-12-21 23:48:23 - theharmonyguy - RT @neiltyson: The best engineering flow chart ever: http://tco/Rs7GNh4Uhttp://www.secuobs.com/twitter/news/277352.shtmlhttp://www.secuobs.com/twitter/news/277352.shtml Secuobs.com : 2011-12-21 23:48:23 - theharmonyguy - btw, haven't forgotten about the HTML5-related XSS I mentioned last week - much to write and it's a live vuln so waiting on disclosurehttp://www.secuobs.com/twitter/news/277351.shtmlhttp://www.secuobs.com/twitter/news/277351.shtml Secuobs.com : 2011-12-21 01:17:36 - theharmonyguy - RT @nathansmith: The Rise and Rise of JavaScript by @tastapod — http://tco/01LX7Qe0 /via @mundizzlehttp://www.secuobs.com/twitter/news/277088.shtmlhttp://www.secuobs.com/twitter/news/277088.shtml Secuobs.com : 2011-12-20 21:22:52 - theharmonyguy - RT @randomdross: XSS Filter Tech: Later is Better http://tco/Wb0NPkZfhttp://www.secuobs.com/twitter/news/276988.shtmlhttp://www.secuobs.com/twitter/news/276988.shtml Secuobs.com : 2011-12-20 08:03:42 - theharmonyguy - RT @elie: Attacking NoSQL and Nodejs: Server-Side JavaScript Injection - http://tco/c4aHZHlO pretty cool #security #infosec #dev http://www.secuobs.com/twitter/news/276772.shtmlhttp://www.secuobs.com/twitter/news/276772.shtml Secuobs.com : 2011-12-20 00:49:51 - theharmonyguy - RT @runasand: Dear Santa, all I want for Christmas is a Burp Pro license, a Raspberry Pi, Little Printer, and two tickets to ShmooConhttp://www.secuobs.com/twitter/news/276664.shtmlhttp://www.secuobs.com/twitter/news/276664.shtml Secuobs.com : 2011-12-20 00:49:51 - theharmonyguy - RT @gattaca: “@ZDNet: Yahoo Mail introduces two factor authentication http://tco/vJR9o8uM” but still no default SSLhttp://www.secuobs.com/twitter/news/276663.shtmlhttp://www.secuobs.com/twitter/news/276663.shtml Secuobs.com : 2011-12-17 02:53:28 - theharmonyguy - I'm one XSS hole away from a pretty disconcerting PoC I'm sure someone's done similar research before, but I don't think I've seen ithttp://www.secuobs.com/twitter/news/276030.shtmlhttp://www.secuobs.com/twitter/news/276030.shtml Secuobs.com : 2011-12-17 02:53:28 - theharmonyguy - And score Hopefully next week: Blog post on how HTML5 can turn reflective XSS into persistent, cross-domain XSS #notkiddinghttp://www.secuobs.com/twitter/news/276029.shtmlhttp://www.secuobs.com/twitter/news/276029.shtml Secuobs.com : 2011-12-16 21:28:32 - theharmonyguy - PDF: RT @superevr Great write up on HTML5 Security: http://tco/u0DN6mHThttp://www.secuobs.com/twitter/news/275940.shtmlhttp://www.secuobs.com/twitter/news/275940.shtml Secuobs.com : 2011-12-16 01:22:49 - theharmonyguy - RT @nathansmith: Google Chrome passes IE8, becomes most popular browser worldwide: http://tco/ug5EiDrj /via @dotcomlarryhttp://www.secuobs.com/twitter/news/275630.shtmlhttp://www.secuobs.com/twitter/news/275630.shtml Secuobs.com : 2011-12-16 01:22:49 - theharmonyguy - @benadida Nice Chrome is my default, but I'll have to check this outhttp://www.secuobs.com/twitter/news/275629.shtmlhttp://www.secuobs.com/twitter/news/275629.shtml Secuobs.com : 2011-12-14 07:50:11 - theharmonyguy - Links on upcoming HTML webcam access: http://tco/NdcfKwI6 http://tco/yeYSt8VB http://tco/3O5y7Xrz cc @jeremiahg @jloidlhttp://www.secuobs.com/twitter/news/274965.shtmlhttp://www.secuobs.com/twitter/news/274965.shtml Secuobs.com : 2011-12-14 07:50:11 - theharmonyguy - @dakami @jeremiahg Devil's Advocate: Fewer computers had webcams and good connections in 2004 But yeah, we'll seehttp://www.secuobs.com/twitter/news/274964.shtmlhttp://www.secuobs.com/twitter/news/274964.shtml Secuobs.com : 2011-12-14 00:53:56 - theharmonyguy - Today I learned that an upcoming HTML feature is native browser access to a user's webcam Should make for some interesting XSS attackshttp://www.secuobs.com/twitter/news/274845.shtmlhttp://www.secuobs.com/twitter/news/274845.shtml Secuobs.com : 2011-12-14 00:53:56 - theharmonyguy - @vogon XSS continues to fascinate me - in a sense, you could call it my favorite vuln :http://www.secuobs.com/twitter/news/274844.shtmlhttp://www.secuobs.com/twitter/news/274844.shtml Secuobs.com : 2011-12-14 00:53:56 - theharmonyguy - I should note that I'm sure HTML webcam access will require authorization, as geolocation does today I just wonder about implementationhttp://www.secuobs.com/twitter/news/274843.shtmlhttp://www.secuobs.com/twitter/news/274843.shtml Secuobs.com : 2011-12-14 00:53:56 - theharmonyguy - RT @digininja: RT @beefproject: RT @antisnatchor: @mtrojnar - Root via XSS oh yes, on the new amazon Kindle http://tco/a4PT8xyAhttp://www.secuobs.com/twitter/news/274842.shtmlhttp://www.secuobs.com/twitter/news/274842.shtml Secuobs.com : 2011-12-10 07:16:49 - theharmonyguy - Wait, Chrome doesn't already have fully sandboxed Flash Guess I hadn't been keeping track but I thought that had already been releasedhttp://www.secuobs.com/twitter/news/273832.shtmlhttp://www.secuobs.com/twitter/news/273832.shtml Secuobs.com : 2011-12-10 07:16:49 - theharmonyguy - RT @justinschuh: Chrome Canary and Dev have an optional alpha of the upcoming fully sandboxed Flash on Windows: http://tco/rsd4hulXhttp://www.secuobs.com/twitter/news/273831.shtmlhttp://www.secuobs.com/twitter/news/273831.shtml Secuobs.com : 2011-12-10 07:16:49 - theharmonyguy - @internot_ @kkotowicz @0x6d6172696f Apparently it works in Java 7 but not Java 6http://www.secuobs.com/twitter/news/273830.shtmlhttp://www.secuobs.com/twitter/news/273830.shtml Secuobs.com : 2011-12-09 17:44:25 - theharmonyguy - RT @kkotowicz: http://tco/GTsY228I Do you think you can dance XSS contest by @0x6D6172696F and @kkotowicz results Gratz for all winnershttp://www.secuobs.com/twitter/news/273607.shtmlhttp://www.secuobs.com/twitter/news/273607.shtml Secuobs.com : 2011-12-09 17:44:25 - theharmonyguy - @0x6D6172696F No, I'm on Java 6 - is that the issuehttp://www.secuobs.com/twitter/news/273606.shtmlhttp://www.secuobs.com/twitter/news/273606.shtml Secuobs.com : 2011-12-09 17:44:25 - theharmonyguy - @kkotowicz @antisnatchor This challenge has certainly not endeared me any more to Java :http://www.secuobs.com/twitter/news/273605.shtmlhttp://www.secuobs.com/twitter/news/273605.shtml Secuobs.com : 2011-12-09 02:59:49 - theharmonyguy - RT @JoshConstine: Facebook Confirms Corporate Reorganization, Focusing On Mobile, Ads, Product, Engineering, Profile http://tco/Aqmp1nt http://www.secuobs.com/twitter/news/273413.shtmlhttp://www.secuobs.com/twitter/news/273413.shtml Secuobs.com : 2011-12-07 04:45:18 - theharmonyguy - RT @briankrebs: CNET's Download dot com bundling adware, toolbars in vs to policy Pushing toolbars with Wireshark, Nmap, etc http:// http://www.secuobs.com/twitter/news/272541.shtmlhttp://www.secuobs.com/twitter/news/272541.shtml Secuobs.com : 2011-12-06 19:25:55 - theharmonyguy - Sounds like the mad scientist @0x6D6172696F is now building a web-based password cracker using CSS and no JavaScripthttp://www.secuobs.com/twitter/news/272338.shtmlhttp://www.secuobs.com/twitter/news/272338.shtml Secuobs.com : 2011-12-06 19:25:55 - theharmonyguy - XSS is generally considered to be a browser attack, but #addingtomyfiles RT @mattjay Look how awesome @theKos is: http://tco/8lPZJBkzhttp://www.secuobs.com/twitter/news/272337.shtmlhttp://www.secuobs.com/twitter/news/272337.shtml Secuobs.com : 2011-12-06 19:25:55 - theharmonyguy - After my last tweet, I've realized that the list I keep of interesting XSS attacks simply must be called The XSS-Fileshttp://www.secuobs.com/twitter/news/272336.shtmlhttp://www.secuobs.com/twitter/news/272336.shtml Secuobs.com : 2011-12-06 19:25:55 - theharmonyguy - RT @BrianHonan: RT @ I've realized the list I keep of interesting XSS attacks simply must be called The XSS-Files T http://www.secuobs.com/twitter/news/272335.shtmlhttp://www.secuobs.com/twitter/news/272335.shtml Secuobs.com : 2011-12-06 19:25:55 - theharmonyguy - RT @paul_irish: http://tco/dIlIYYsc features a snappy search UI to all of MDN's javascript/css/html/dom documentation Very nicehttp://www.secuobs.com/twitter/news/272334.shtmlhttp://www.secuobs.com/twitter/news/272334.shtml Secuobs.com : 2011-12-06 02:10:04 - theharmonyguy - @jeremiahg @codepo8 Some interesting points, but still strikes me as an oversimplification Many of Google's Chrome-only apps arehttp://www.secuobs.com/twitter/news/272066.shtmlhttp://www.secuobs.com/twitter/news/272066.shtml Secuobs.com : 2011-12-06 02:10:04 - theharmonyguy - @jeremiahg @codepo8 limited by choice/distribution, not technology For instance, Chrome Angry Birds runs fine in Firefoxhttp://www.secuobs.com/twitter/news/272065.shtmlhttp://www.secuobs.com/twitter/news/272065.shtml Secuobs.com : 2011-12-04 00:01:31 - theharmonyguy - RT @paul_irish: When you're optimizing performance of your site/app, your priorities are 1 Network connections 2 DOM access 3 Javascr http://www.secuobs.com/twitter/news/271565.shtmlhttp://www.secuobs.com/twitter/news/271565.shtml Secuobs.com : 2011-12-02 23:45:40 - theharmonyguy - Note the first one - eval also not good for performance reasons RT @johnwilander A guide to efficient JavaScript: http://tco/jyvJbcZghttp://www.secuobs.com/twitter/news/271311.shtmlhttp://www.secuobs.com/twitter/news/271311.shtml Secuobs.com : 2011-12-02 23:45:40 - theharmonyguy - RT @gattaca: “@CNETNews: How Carrier IQ was wrongly accused of keylogging http://tco/H0EPJ0mV” by some perhaps The potential fo http://www.secuobs.com/twitter/news/271310.shtmlhttp://www.secuobs.com/twitter/news/271310.shtml Secuobs.com : 2011-12-02 01:36:34 - theharmonyguy - RT @securityninja: Reverse Engineering Web Apps: Architectural Composition another great blog post from @kuzushi http://tco/KFRnoISPhttp://www.secuobs.com/twitter/news/270885.shtmlhttp://www.secuobs.com/twitter/news/270885.shtml Secuobs.com : 2011-12-01 01:22:38 - theharmonyguy - This is madness This is JAVAhttp://www.secuobs.com/twitter/news/270559.shtmlhttp://www.secuobs.com/twitter/news/270559.shtml Secuobs.com : 2011-12-01 01:22:38 - theharmonyguy - Think I just earned a heart in the So you think you can dance XSS challenge : Learned a ton Try it yourself: http://tco/rh2hbCrIhttp://www.secuobs.com/twitter/news/270558.shtmlhttp://www.secuobs.com/twitter/news/270558.shtml Secuobs.com : 2011-11-30 02:29:53 - theharmonyguy - Work on this Java-based XSS challenge is not increasing my love for Javahttp://www.secuobs.com/twitter/news/270185.shtmlhttp://www.secuobs.com/twitter/news/270185.shtml Secuobs.com : 2011-11-29 01:20:29 - theharmonyguy - Yikes, an XSS challenge that requires Java See if you can outsmart @0x6D6172696F and @kkotowicz: http://tco/8ZxLFt0Ohttp://www.secuobs.com/twitter/news/269797.shtmlhttp://www.secuobs.com/twitter/news/269797.shtml Secuobs.com : 2011-11-29 01:20:29 - theharmonyguy - @0x6D6172696F @thewildcat lol very nice - I'm still working on figuring out this Java interfacehttp://www.secuobs.com/twitter/news/269796.shtmlhttp://www.secuobs.com/twitter/news/269796.shtml Secuobs.com : 2011-11-28 17:47:24 - theharmonyguy - FYI: New XSS challenge from @0x6D6172696F and @kkotowicz apparently arriving today at 3 pm Easternhttp://www.secuobs.com/twitter/news/269659.shtmlhttp://www.secuobs.com/twitter/news/269659.shtml Secuobs.com : 2011-11-24 02:31:55 - theharmonyguy - Worked on my iPhone #jsrocks RT @dakami http://tco/UxrqHW0w Face Detection In JavaScript rlyhttp://www.secuobs.com/twitter/news/268611.shtmlhttp://www.secuobs.com/twitter/news/268611.shtml Secuobs.com : 2011-11-23 04:05:55 - theharmonyguy - Speculation that SSL certificates abused in the wild had their 512-bit RSA keys factored: http://tco/8tFPzTGK via @mikkohttp://www.secuobs.com/twitter/news/268295.shtmlhttp://www.secuobs.com/twitter/news/268295.shtml Secuobs.com : 2011-11-21 20:51:22 - theharmonyguy - From the Never Underestimate JavaScript Dept: RT @securityninja JavaScript JVM runs Java wow http://tco/R80BuSwVhttp://www.secuobs.com/twitter/news/267910.shtmlhttp://www.secuobs.com/twitter/news/267910.shtml Secuobs.com : 2011-11-21 20:51:22 - theharmonyguy - RT @superevr: RT @garethheyes: JavaScript is the cause of and solution to the web's problems That's deephttp://www.secuobs.com/twitter/news/267909.shtmlhttp://www.secuobs.com/twitter/news/267909.shtml Secuobs.com : 2011-11-17 09:01:04 - theharmonyguy - @satnam Perhaps I think the main point is that while the effect is the same as XSS, the action/method is quite differenthttp://www.secuobs.com/twitter/news/266619.shtmlhttp://www.secuobs.com/twitter/news/266619.shtml Secuobs.com : 2011-11-17 09:01:04 - theharmonyguy - @satnam I'm just seeing people say browsers allow XSS to happen or that the attack is being caused by XSS vulnerabilitieshttp://www.secuobs.com/twitter/news/266618.shtmlhttp://www.secuobs.com/twitter/news/266618.shtml Secuobs.com : 2011-11-17 09:01:04 - theharmonyguy - RT @garethheyes: Here are my non-alphanumeric JavaScript PHP slides http://tco/0dbhNdS3 powerpoint http://tco/EtniM1Jf pdfhttp://www.secuobs.com/twitter/news/266617.shtmlhttp://www.secuobs.com/twitter/news/266617.shtml Secuobs.com : 2011-11-17 09:01:04 - theharmonyguy - @jeremiahg @bsterne @satnam In my tests, type j first still fails in IE9 and of course Firefox but works in Chromehttp://www.secuobs.com/twitter/news/266616.shtmlhttp://www.secuobs.com/twitter/news/266616.shtml Secuobs.com : 2011-11-16 22:50:13 - theharmonyguy - RT @CodeWisdom: Java is to JavaScript what Car is to Carpet - Chris Heilmannhttp://www.secuobs.com/twitter/news/266468.shtmlhttp://www.secuobs.com/twitter/news/266468.shtml Secuobs.com : 2011-11-16 22:50:13 - theharmonyguy - Seeing the term self-XSS create some confusion in the tech media about the differences between it and actual XSShttp://www.secuobs.com/twitter/news/266467.shtmlhttp://www.secuobs.com/twitter/news/266467.shtml Secuobs.com : 2011-11-16 22:50:13 - theharmonyguy - @Ansjh Getting a user to paste JavaScript into the address bar Same effect as XSS, but the user manually executes the scripthttp://www.secuobs.com/twitter/news/266466.shtmlhttp://www.secuobs.com/twitter/news/266466.shtml Secuobs.com : 2011-11-16 22:50:13 - theharmonyguy - If XSS is someone poisoning your drink, self-XSS is you poisoning it yourself and browser patches for self-XSS are locks on your poison jarhttp://www.secuobs.com/twitter/news/266465.shtmlhttp://www.secuobs.com/twitter/news/266465.shtml Secuobs.com : 2011-11-16 09:54:29 - theharmonyguy - @satnam @paperghost @Wh1t3Rabbit Maybe for quicker detection and limiting scope, but we are talking XSS here - only so much you can dohttp://www.secuobs.com/twitter/news/266294.shtmlhttp://www.secuobs.com/twitter/news/266294.shtml Secuobs.com : 2011-11-16 01:38:45 - theharmonyguy - RT @lcamtuf: The Tangled Web is out Instantly downloadable PDF with print copies Use code TANGLEDWEB to get 40 pourcents off: http://tco/ZpM http://www.secuobs.com/twitter/news/266134.shtmlhttp://www.secuobs.com/twitter/news/266134.shtml Secuobs.com : 2011-11-16 01:38:45 - theharmonyguy - @jjarmoc Copy/paste XSS scams have spread pretty well in the past I wonder what browsers the victims were usinghttp://www.secuobs.com/twitter/news/266133.shtmlhttp://www.secuobs.com/twitter/news/266133.shtml Secuobs.com : 2011-11-12 02:39:39 - theharmonyguy - @skeptic_fx Death The JavaScript frame buster is still there in addition to X-Frame-Optionshttp://www.secuobs.com/twitter/news/265301.shtmlhttp://www.secuobs.com/twitter/news/265301.shtml Secuobs.com : 2011-11-12 02:39:39 - theharmonyguy - RT @ErikArvidsson: Operator and = overloading in JavaScript* http://tco/qB1hCisi* = Traceur Compilerhttp://www.secuobs.com/twitter/news/265300.shtmlhttp://www.secuobs.com/twitter/news/265300.shtml Secuobs.com : 2011-11-11 01:01:48 - theharmonyguy - RT @securityninja: RT @XSSniper: Try SQLi on this http://tco/zjNBR5yChttp://www.secuobs.com/twitter/news/264959.shtmlhttp://www.secuobs.com/twitter/news/264959.shtml Secuobs.com : 2011-11-11 01:01:48 - theharmonyguy - @garethheyes So if xss= or iframe, style, etc, the 2nd lives But attribs stripped, scripts whitelistedhttp://www.secuobs.com/twitter/news/264958.shtmlhttp://www.secuobs.com/twitter/news/264958.shtml Secuobs.com : 2011-11-10 00:26:37 - theharmonyguy - @KimZetter Shouldn't it be DNS hijacking, not clickjacking Not trying to be too picky, but accepted definition of latter is differenthttp://www.secuobs.com/twitter/news/264384.shtmlhttp://www.secuobs.com/twitter/news/264384.shtml Secuobs.com : 2011-11-10 00:26:37 - theharmonyguy - @Joab_Jackson Shouldn't it be DNS hijacking, not clickjacking Not trying to be too picky, but latter's accepted definition is differenthttp://www.secuobs.com/twitter/news/264383.shtmlhttp://www.secuobs.com/twitter/news/264383.shtml Secuobs.com : 2011-11-09 16:37:48 - theharmonyguy - RT @jonoberheide: For everyone freaking out over UDP: it's a refcount so it'll probably take 2^32 packets to overflow the counter, and o http://www.secuobs.com/twitter/news/264244.shtmlhttp://www.secuobs.com/twitter/news/264244.shtml Secuobs.com : 2011-11-09 16:37:48 - theharmonyguy - @skeptic_fx Ah, correct - I didn't realize Firefox had removed execution of javascript: URLs in the address bar with version 6http://www.secuobs.com/twitter/news/264243.shtmlhttp://www.secuobs.com/twitter/news/264243.shtml Secuobs.com : 2011-11-08 23:01:21 - theharmonyguy - @garethheyes Does that actually execute the script on one browser I tried it in Chrome, Firefox, and IEhttp://www.secuobs.com/twitter/news/264050.shtmlhttp://www.secuobs.com/twitter/news/264050.shtml Secuobs.com : 2011-11-08 23:01:21 - theharmonyguy - @garethheyes Hmm, not working for me in FF7 and Chrome 17, though the output is differenthttp://www.secuobs.com/twitter/news/264049.shtmlhttp://www.secuobs.com/twitter/news/264049.shtml Secuobs.com : 2011-11-08 23:01:21 - theharmonyguy - @superevr @garethheyes I want to play with these vectors, but for me, the img stays in comments on Chrome/IE, attribs get stripped in FFhttp://www.secuobs.com/twitter/news/264048.shtmlhttp://www.secuobs.com/twitter/news/264048.shtml Secuobs.com : 2011-11-08 04:14:54 - theharmonyguy - @AndyPalmer Type +pepsi in Chrome's address barhttp://www.secuobs.com/twitter/news/263835.shtmlhttp://www.secuobs.com/twitter/news/263835.shtml Secuobs.com : 2011-11-07 23:22:38 - theharmonyguy - @garethheyes I was thinking maybe you could set a payload for windowonload that would execute after JSLR has runhttp://www.secuobs.com/twitter/news/263729.shtmlhttp://www.secuobs.com/twitter/news/263729.shtml Secuobs.com : 2011-11-07 23:22:38 - theharmonyguy - Interesting: Amazon noticed I'd been ignoring all their AmazonLocal emails, so they're automatically unsubscribing mehttp://www.secuobs.com/twitter/news/263728.shtmlhttp://www.secuobs.com/twitter/news/263728.shtml Secuobs.com : 2011-11-07 23:22:38 - theharmonyguy - If you love XSS challenges and you aren't trying to tear apart JSLR, you're seriously missing out: http://tco/W9PmQuP6http://www.secuobs.com/twitter/news/263727.shtmlhttp://www.secuobs.com/twitter/news/263727.shtml