Cross Site Request Forgery (CSRF) is a pretty straightforward flaw to take advantage of. Explaining it can be more difficult, due to the number of conditions that have to be met. This post isn’t meant to be a primer on CSRF, but here are the conditions that must occur. The targeted app has a critical transaction that uses predictable inputs … Read More
Perils in Session Management: JWT Edition
Session management is a critical area to get right in developing a web application. The developer has to get it right or the entire app is risk of being compromised. Fortunately, the development frameworks have attempted to make this an implementation issue rather than a development issue. A developer just has to pick the mechanism for session management and implement … Read More
Make Security Awareness Training Real
Think about the last security awareness training that you were forced to sit through by your employer. Do you remember anything specific from it? Neither can I. Why is that? Personally I believe it is because most of our awareness training is boring and isn’t written in a way that’s interesting at all. They dump tons of information at us, … Read More
New Open Source Project Created – Reconnoiter
Earlier this month I decided to take the scripts for username generation and roll them into an open source project. There were a couple of reasons for doing so. First, I needed source control hosting and SourceForge provides that for free as long as you release the project to the public. Second, I want to expand the scope of it … Read More
URL Encoder and Decoder
I frequently have to do a quick bit of URL encoding and decoding as part of my daily routine. I’ve been using a particular site for most of this, but I’ve never really become comfortable with putting some of these things into someone else’s web site. So I used the code as found here and created my own page to … Read More