Top all-time · #8387
James Kettle
Personal blog · skeletonscribe.netsecurityweb
James Kettle's personal blog at skeletonscribe.net covers security and web. Since 2013, 9 different Hacker News readers have linked it 10 times, most often “Practical HTTP Host header attacks”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN commenters link James Kettle's security research posts as background, citing his write-up on Host header attacks and password reset poisoning, and his sparse brute-force Chrome extension enumeration post.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Practical HTTP Host header attacks3 people · 3 mentions · first linked 2013-05-02
- Reviewing bug bounties – a hacker's perspective2 people · 2 mentions · first linked 2016-08-11
What Hacker News says?
This sounds like something along the lines of password reset poisoning as described in James Kettles' technical write-up "Practical HTTP Host header attacks". [1] [1]: http://www.skeletonscribe.net/2013/05/practical-http-host-he... .
Comment linking /2013/05/practical-http-host-header-attacks.html
on “ASP.NET Core Elevation Of Privilege Vulnerability”Submitted Reviewing bug bounties – a hacker's perspective as a story · 6 points
HN discussionGeneral-purpose Chrome extension enumeration[1] should have been fixed some time ago, maybe here: http://crbug.com/45876 There are still issues with fingerprinting based on specific attributes of a particular extension (for example: [2]), however. 1: http://www.skeletonscribe.net/2011/07/sparse-bruteforce-addo... 2: http://blog.securitee.org/?p=277
Comment linking /2011/07/sparse-bruteforce-addon-scanner.html
on “Chameleon: browser fingerprinting protection for everybody”Submitted Practical HTTP Host header attacks as a story · 5 points
HN discussionSubmitted Practical HTTP Host header attacks as a story · 4 points
HN discussionSubmitted Abusing OWASP with 'Insufficient Attack Protection' as a story · 3 points
HN discussionSubmitted Password Reset and Web-Cache Poisoning (and a Little Surprise in RFC-2616) as a story · 2 points
HN discussionSubmitted Reviewing bug bounties – a hacker's perspective as a story · 2 points
HN discussionSubmitted Practical HTTP Host header attacks as a story · 2 points
HN discussionSubmitted @albinowax: CTF Writeup [H1-212] as a story · 1 points
HN discussion
