Nilesh Kumar

Though it was easy to capture the traffic of web service running on local pc in Firefox, it was little tricky in case of IE. I have heard that .Net and IE don't send traffic to localhost through a proxy, so here the proxies such as Burp, Paros fails. So only way is to use Firefox or other browsers which support it or in case of IE, this is workaround: Go to Windows-> System32-> Drivers-> Hosts and make the following entry: 127.0.0.1  myDomain.com Now access the site as http://myDomain.com Now the Burp/ Paros would be able to capture the traffic!

The sole purpose of (secret) CRSF token is to help the application identify authenticated or unauthenticated requests. Any request that doesn’t contain csrf tokens are treated as unauthenticated one thus rejected by the application as the csrf tokens are only available to the authenticated users. But contrary to that, in one application, the csrf tokens are generated before login and worse, it’s not regenerated after successful authentication of the user. This defeats the purpose of anti-csrf approach. Anti-CSRF best practices:     Don’t issue csrf tokens before authentication     Always regenerate the tokens after successful authentication, if issued before authentication     Use POST methods for critical transactions embedding csrf tokens     Don’t send the csrf tokens in GET requests as they may reveal it in browser logs etc In few Ruby based apps, where the token was being generated before authentication and same was being...

The term is new, but concept is not. Throughout the history of computing, IT organizations have been using their own infrastructure to host applications, data, servers etc. Now most of them are renting the infrastructure, with remote servers to host their application or data. Organizations called service providers exist especially to provide, manage and maintain the infrastructure on which their client organization’s application or data are hosted. The client organization gets access controls to manage their applications and data hosted on the remote server. This is the main idea behind cloud computing. More here ....

The issue: While doing one assessment, we faced one issue of our ZAP proxy throwing response ‘401 Unauthorized’ while we were trying to fuzz one application. The application was using NTLM authentication, where the client needs to send the domain name, username and user-password’s hash combination to the server, in order to entertain the requests. NTLM is windows challenge/ response authentication protocol. For more info on NTLM working: http://msdn.microsoft.com/en-us/library/windows/desktop/aa378749%28v=vs.85%29.aspx . So, we were not able to fuzz the parameters as it was sending back ‘401 Unauthorized’ response, don’t know for what reason despite us providing the windows credentials to ZAP [Fig-1].  Fig-1 So, we had no other option except trying other similar web proxies. We tried WebScarab and provided Windows authentication by going Tools-> Credentials [Fig-2]             ...

The following functions needs to be inspected for XSS as they might be 'possible' pointers to XSS. They could be a pointer to possible xss attacks: eval() document.write() innerHTML() write() Safe function: Instead of using innerHTML, one should use innerText()   XSS payload in Jason and their effects: A nice example from iSec Partners: var inboundJSON = {"people": [ {"name": "Joel", "address": “<script>badStuff();</script>", "phone": “911"} ] }; someObject.innerHTML(inboundJSON.people[0].address);               // Vulnerable document.write(inboundJSON.people[0].address);                             // Vulnerable someObject.innerText(inboundJSON.people[0].address                     // Not Vulnerable

A nice article on a detailed assessment strategy of Android applications. Well explained and comprehensively written. Article describes different stages in android assessment, tools, methodologies and native tools with screenshots. You can find the article here: Android Application Assessmen t Also have a look at Web application Security Course offered by InfosecInstitute.