Top all-time · #18002
Egor Homakov
Personal blog · homakov.github.iosecurityprogramming
Egor Homakov's personal blog at homakov.github.io covers security and programming. Since 2013, 4 different Hacker News readers have linked it 8 times. No feed was found, so read it on the site itself.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Egor Homakov's blog posts demonstrate web security tricks, such as a CAPTCHA demo page and cross-frame manipulation via Googleusercontent.com iframes. Commenters link to the demos and describe how they work.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /guc.html2 people · 2 mentions · first linked 2013-07-27
What Hacker News says?
Trigger warning: passing the CAPTCHA on homakov's demo page ( https://homakov.github.io/nocaptcha.html ) registers an account (blog?) at wordpress.org.
Comment linking /nocaptcha.html
on “The No CAPTCHA problem”Submitted Camjacking: Click and say Cheese as a story · 11 points
HN discussionIt's simple really if you understand what's going on. iframe code can access `frames[0].document` cross domain. Clicking on the link within Google Translate iframe modifies target page on another domain. curl http://homakov.github.io/guc.html
Comment linking /guc.html
on “Googleusercontent.com fun”Submitted Hijacking your GitHub in one click as a story · 4 points
HN discussionVery interesting! URL manipulation also resulted in more goodies. http://homakov.github.io/
Comment linking /
on “Googleusercontent.com fun”no cookie/XSS or any real vuln here involved. This is completely standard design problem of sandbox domain. Check out http://homakov.github.io/guc.html
Comment linking /guc.html
on “Googleusercontent.com fun”CSRF http://homakov.github.io/#{"url":"https://anonyfish.com/api/... also why not it snap-chat style and remove messages after 10 s?
Comment linking /
on “Anonyfish – Chat Anonymously With Another Secret User”BTW, clickjacking was fixed few weeks ago and http://homakov.github.io/nocaptcha.html isn't working anymore.
Comment linking /nocaptcha.html
on “Sorry Google, No CAPTCHA ReCAPTCHA Doesn’t Stop Bots”