Top all-time · #1304
ha.ckers.org
Personal blog · ha.ckers.orgsecurity
ha.ckers.org is a personal blog at ha.ckers.org about security. Since 2008, 57 different Hacker News readers have linked it 64 times, most often “XSS (Cross Site Scripting) Cheat Sheet”. No feed was found, so read it on the site itself.
Most-linked posts?
- XSS (Cross Site Scripting) Cheat Sheet15 people · 16 mentions · first linked 2008-04-09
- Slowloris - the low bandwidth, yet greedy and poisonous HTTP client11 people · 11 mentions · first linked 2009-06-20
- /weird/CSS-history-hack.html3 people · 3 mentions · first linked 2009-04-26
- Anonymous Proxy Woes2 people · 2 mentions · first linked 2010-01-04
- Slowloris HTTP DoS2 people · 2 mentions · first linked 2009-06-18
- /2 people · 2 mentions · first linked 2010-09-24
What Hacker News says?
Well, nginx started because Apache devs didn't want to address the issue that arised when lots of users with slow connections were accessing the site. Anyone else remember the Slowloris HTTP DoS - ngingx is basically immune to it... As Sysoev was working for one of the Russia's biggest portals that apache couldn't handle very well.. So he wrote a server that did one thing very well - waits until client submits their…
Comment linking /slowloris/
on “Nginx, the little Russian web server taking on the giants”Submitted Slowloris - the low bandwidth, yet greedy and poisonous HTTP client as a story · 93 points
HN discussionWell, I don't have a ready reference for SQL injections, but how about one for XSS? http://ha.ckers.org/xss.html If that doesn't teach you anything, well, my hat's off to you.
Comment linking /xss.html
on “Security Lessons Learned From The Diaspora Launch”Submitted XSS (Cross Site Scripting) Cheat Sheet as a story · 63 points
HN discussionFor deployment, it's also important to have something like nginx in front of Gunicorn to buffer requests from slow clients. Otherwise, this sort of thing can DoS your server pretty bad: http://ha.ckers.org/slowloris/
Comment linking /slowloris/
on “The Flask Mega-Tutorial”Submitted XSS (Cross Site Scripting) Cheat Sheet as a story · 39 points
HN discussionThe decoded URL for this submission is http://184.172.10.74/ — the server for Hacker News. Here's some other encodings you can use for the same address, they're all valid and recognised by most browsers and other software: http://3098282570/ http://7393249866/ http://0xb8.0xac.0x0a.0x4a/ http://0270.0254.0012.0112/ The source for this comment is an XSS filtering bypass tool by RSnake — http://ha.ckers.org/xsscalc.ht…
Comment linking /xsscalc.html
on “This is a valid ipv4 address”Submitted Petabytes on the cheap as a story · 30 points
HN discussionActually, it's not easy. It's incredibly difficult to have a webapp with a wide range of functionality that doesn't leak data to SQL injections. There's plenty of stuff that can get past the precautions you listed[1][2], although pornel is closer to the mark. [1] http://ha.ckers.org/sqlinjection/ [2] https://docs.google.com/viewer?url=http://www.ihteam.net/pap...
Comment linking /sqlinjection/
on “LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census”Submitted Web Server Log Forensics App Wanted as a story · 11 points
HN discussionHave some more nightmare fuel: http://ha.ckers.org/xss.html You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose. As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted b…
Comment linking /xss.html
on “#1 CSRF Is A Vulnerability In All Browsers”Submitted XSS (Cross Site Scripting) Cheat Sheet as a story · 10 points
HN discussionThis post follow along the same lines, however a bit more blackhat[1]. He also did another write up about using images to store xss data a while back. It is great if the image is loaded into javascript, other wise it will not work. http://ha.ckers.org/blog/20070604/passing-malicious-php-thro...
Comment linking /blog/20070604/passing-malicious-php-through-getimagesize/
on “Want to pack JS and CSS really well? Convert it to a PNG”Submitted Slowloris HTTP DoS as a story · 6 points
HN discussionSo even if Scala is ahead in this (flawed) benchmark, that's not how you write a TCP server in Scala, because you want to do it non-blocking. Not doing it based on asynchronous I/O means that in a real-world scenario the server will choke under the weight of slow connections, not to mention be susceptible to really cheap DoS attacks like Slowloris [1]. Seriously, it goes beyond the underlying I/O API that you're usi…
Comment linking /slowloris/
on “Scala vs. Go TCP Benchmark”Submitted CSS history hack used to ban torrent users as a story · 5 points
HN discussionDoesn't that mean you only need to control http://ha.ckers.org/s.js (or similar) rather than write a book?
Comment linking /s.js
on “Stored XSS Vulnerability in Amazon (or How to hack Amazon with a book)”Submitted Clickjacking Details as a story · 4 points
HN discussionInterestingly the "enumerator" tool doesn't list all my extensions, and it lists even less when testing on the machine running the beta channel (18). Similar behavior Firefox exhibits regarding: http://ha.ckers.org/weird/firefox-extentions.html
Comment linking /weird/firefox-extentions.html
on “Web pages can sniff to see what Chrome extensions you have installed”Submitted Slowloris HTTP DoS as a story · 3 points
HN discussionYup: https://panopticlick.eff.org/ Also: http://ha.ckers.org/weird/firefox-extentions.html
Comment linking /weird/firefox-extentions.html
on “Web pages can sniff to see what Chrome extensions you have installed”Submitted The Effect of Snakeoil Security as a story · 3 points
HN discussionI can't get this to work; low end laptop with low end gpu. But is it anything like what Rsnake posted on ha.ckers.org? Link: http://ha.ckers.org/blog/20070623/hiding-js-in-valid-images/ Example: https://github.com/christopherwoodall/ImgJs
Comment linking /blog/20070623/hiding-js-in-valid-images/
on “Show HN: My first WebGL demo, the first self-extracting PNG ever?”Submitted What Star Trek Predicts About The Future of Information Security as a story · 3 points
HN discussioni think most of that has been summarized at http://ha.ckers.org/xss.html
Comment linking /xss.html
on “Get any a-Z char using only []()+{}/. in JavaScript (for XSS obfuscation)”Submitted XSS (Cross Site Scripting) Cheat Sheet as a story · 2 points
HN discussionJust a public service announcement-- for those of you looking to validate your own site for XSS exploits, you'll find that this list is particularly good at giving you "problem" strings to test against: http://ha.ckers.org/xss.html We honestly thought we secured XSS with common libraries on every field for one of our sites, but we paid a contractor to go through and use those strings in various unexpected places and…
Comment linking /xss.html
on “Massive Twitter Cross-Site Scripting Vulnerability”Submitted Quick Proxy Detection as a story · 2 points
HN discussionIsn't this better? http://ha.ckers.org/xss.html
Comment linking /xss.html
on “XSS Prevention Cheat Sheet”Submitted Mozilla Plans Fix for CSS History Hack as a story · 2 points
HN discussion
