Top all-time · #6886
thespanner.co.uk
Personal blog · thespanner.co.uksecurityprogramming
thespanner.co.uk is a personal blog at thespanner.co.uk about security and programming. Since 2009, 12 different Hacker News readers have linked it 17 times, most often “JSON Hijacking”. No feed was found, so read it on the site itself.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Gareth Heyes's blog on JavaScript weirdness and hacking, cited for web security topics such as XSS, JSON hijacking, iframe security and a Firefox vulnerability.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- JSON Hijacking2 people · 2 mentions · first linked 2011-05-30
What Hacker News says?
The unencrypted (or more importantly, unauthenticated) content loading into the iframe is subject to any number of malicious content injection techniques. E.g. http://www.thespanner.co.uk/2007/10/24/iframes-security-summ... Professional malware distributors seem perfectly happy to obtain placement inside an iframe: http://www.usenix.org/event/hotbots07/tech/full_papers/provo... Edit: Also, don't you trigger mixed co…
Comment linking /2007/10/24/iframes-security-summary/
on “Javascript Cryptography Considered Harmful”Submitted JSON Hijacking as a story · 4 points
HN discussionActually it's much worse, it's the equivalent of calling a function that ends up doing something totally different than you thought it would. Very reminiscent of a web bug that has since been blocked by newer browsers: parsing JSON data that ends up using a constructor redefinition exploit to execute arbitrary JS. Pretty much this: http://www.thespanner.co.uk/2011/05/30/json-hijacking/
Comment linking /2011/05/30/json-hijacking/
on “Chasing the DAO Attacker’s Wake – A second exploit”Submitted Breaking HTML parsers for fun as a story · 3 points
HN discussionBecause an 11-year-old answer was just deleted by the SO "not an answer" hammer, here are the links from the SO post you mentioned: - http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-inje... - http://archive.is/20150708191322/http://i8jesus.com/?p=10 - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
Comment linking /2007/11/26/ultimate-xss-css-injection/
on “Show HN: Blunt – A CSS Layout Framework for Minimalists”Submitted Unbreakable filter as a story · 2 points
HN discussionThis article is written by Gareth Heyes. He has a blog about JavaScript weirdness and hacking: http://www.thespanner.co.uk/
Comment linking /
on “JavaScript for hackers”Submitted Non-alpha numeric PHP code tutorial as a story · 2 points
HN discussionIf you're curious like I was, you can find the details of the vulnerability described by Gareth Heyes at http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-yo... His proof-of-concept of the vulnerability can be found at http://www.businessinfo.co.uk/labs/firefox_knows_what_your_f... (Best fetched via curl... or Firefox 16.0 with an active Twitter session if you're daring.) Or you can just see the source here:…
Comment linking /2012/10/10/firefox-knows-what-your-friends-did-last-summer/
on “Mozilla pulls day-old Firefox 16 from download site over security risk”Submitted Eval a url as a story · 2 points
HN discussionSubmitted Protecting against XSS as a story · 2 points
HN discussionSubmitted Mutation XSS as a story · 1 points
HN discussionSubmitted One-liner JavaScript browser detection (2009) as a story · 1 points
HN discussionSubmitted JSLR - ASLR for JavaScript as a story · 1 points
HN discussionSubmitted XSS technique without parentheses as a story · 1 points
HN discussionSubmitted The JSON specification is now wrong as a story · 1 points
HN discussionSubmitted Twitter misidentifying context as a story · 1 points
HN discussion
