The Web Security Mailing List (2006 May)

• Thread Index

• Re: [WEB SECURITY] Re: cookies a fundamental threat (or risk)?
  • From: Pilon Mntry
• [WEB SECURITY] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• Re: [WEB SECURITY] Re: cookies a fundamental threat (or risk)?
  • From: Prasad Shenoy
• [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: MindsX
• RE: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Bill McGee \(bam\)
• Re: [WEB SECURITY] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Achim Hoffmann
• [WEB SECURITY] Article addresses layered approach to app security
  • From: Davidson, Michelle
• RE: [WEB SECURITY] another good guy is charged
  • From: Aiken, Dan
• Re: [WEB SECURITY] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• Re: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Brian Eaton
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Tom Stripling
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Brian Eaton
• Re: [WEB SECURITY] Technical Note by Amit Klein: "Path Insecurity"
  • From: Brian Eaton
• Re: [WEB SECURITY] Technical Note by Amit Klein: "Path Insecurity"
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] Technical Note by Amit Klein: "Path Insecurity"
  • From: Brian Eaton
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Martin O'Neal
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• Re: [WEB SECURITY] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Achim Hoffmann
• Re: [WEB SECURITY] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• [WEB SECURITY] By default, the Verifier is disabled on .Net and Java
  • From: Dinis Cruz
• Re: [WEB SECURITY] By default, the Verifier is disabled on .Net and Java
  • From: Stephen de Vries
• Re: [WEB SECURITY] Technical Note by Amit Klein: "Path Insecurity"
  • From: Amit Klein (AKsecurity)
• [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• [WEB SECURITY] Re: By default, the Verifier is disabled on .Net and Java
  • From: Roman H.
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Brian Eaton
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Brian Eaton
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Achim Hoffmann
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Pilon Mntry
• [WEB SECURITY] Dynamic Evaluation Vulnerabilities in PHP applications
  • From: Steven M. Christey
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Martin O'Neal
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Tom Stripling
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Peter Watkins
• [WEB SECURITY] security etiquette?
  • From: solutions_PHP
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Amit Klein (AKsecurity)
• [WEB SECURITY] White Paper: Cross-Site Scripting Worms and Viruses
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Achim Hoffmann
• RE: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Patrick Wolf
• [WEB SECURITY] Java -noverify PoC
  • From: Dinis Cruz
• Re: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• Re: [WEB SECURITY] Java -noverify PoC
  • From: Stephen de Vries
• Re: [WEB SECURITY] Java -noverify PoC
  • From: Jim Halfpenny
• Re: [WEB SECURITY] security etiquette?
  • From: Carl Jongsma
• Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] security etiquette?
  • From: solutions_PHP
• [WEB SECURITY] Re: Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dean H. Saxe
• [WEB SECURITY] Acegi Security for Spring Framework
  • From: Davidson, Michelle
• [WEB SECURITY] Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1
  • From: Zaninotti, Thiago
• [WEB SECURITY] Question about JavaScript
  • From: shadi Aljawarneh
• RE: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Kit Wetzler
• Re: [WEB SECURITY] Question about JavaScript
  • From: Chris Varenhorst
• RE: [WEB SECURITY] Question about JavaScript
  • From: nospam
• RE: [WEB SECURITY] Question about JavaScript
  • From: Matt Fisher
• Re: [WEB SECURITY] Question about JavaScript
  • From: Brian Eaton
• RE: [WEB SECURITY] Question about JavaScript
  • From: dpw
• Re: [WEB SECURITY] Question about JavaScript
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] Question about JavaScript
  • From: John Bond
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Evans, Arian
• [WEB SECURITY] What is the status of AVDL
  • From: Dinis Cruz
• [WEB SECURITY] HTML or XML form
  • From: shadi Aljawarneh
• [WEB SECURITY] Why Novell should take on the 'type-safe platform' challenge
  • From: Dinis Cruz
• RE: [WEB SECURITY] What is the status of AVDL
  • From: Kurt R. Roemer
• Re: [WEB SECURITY] cookies a fundamental threat?
  • From: Brian Eaton
• [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Davidson, Michelle
• [WEB SECURITY] pushing disclosure underground
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Matt Fisher
• RE: [WEB SECURITY] cookies a fundamental threat?
  • From: Evans, Arian
• RE: [WEB SECURITY] Question about JavaScript
  • From: Joe White
• RE: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Darren Webb
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Daniel
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Matt Fisher
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Scott Bardsley
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Aaron C. Newman (AppSecInc)
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Evans, Arian
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Evans, Arian
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Régis Gabineski
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Will Jefferies
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] pushing disclosure underground
  • From: robert
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Matt Fisher
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Ryan Barnett
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Syed Mohamed A
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Brian Eaton
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Joe White
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Evans, Arian
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Erwin Geirnaert
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Evans, Arian
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Joseph Peloquin
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Evans, Arian
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Brian Eaton
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Leonardo Alcantara Moreira
• [WEB SECURITY] strip/sanitize comments in production code?
  • From: Joe White
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Joshua J. Pennell
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Brian Eaton
• Re: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Jason Muskat
• Re: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Dan Kuykendall
• RE: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Davidson, Michelle
• RE: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: valkyrie
• RE: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Gavin, Michael
• Re: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Brian Eaton
• RE: [WEB SECURITY] pushing disclosure underground
  • From: Leonardo Alcantara Moreira
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Zaninotti, Thiago
• RE: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Chris Weber
• Re: [WEB SECURITY] Q&A: Gary McGraw talks about building security into the SDLC
  • From: Jason Muskat
• Re: [WEB SECURITY] pushing disclosure underground
  • From: Achim Hoffmann
• [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Ryan Barnett
• Re: [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Jeremiah Grossman
• [WEB SECURITY] anti-phishing toolbar research
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Ofer Shezaf
• Re: [WEB SECURITY] anti-phishing toolbar research
  • From: Gervase Markham
• Re: [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Paul Schmehl
• Re: [WEB SECURITY] Re: [Owasp-dotnet] Review of Owasp-London Chapter meeting on WAF (Web Application Firewalls)
  • From: Dinis Cruz
• RE: [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Ofer Shezaf
• RE: [WEB SECURITY] News Article - Ohio University suffers massive security breach
  • From: Schmidt, Albert E
• [WEB SECURITY] OHIO state incident
  • From: Albert
• [WEB SECURITY] Fwd: OHIO state incident
  • From: Albert
• RE: [WEB SECURITY] Fwd: OHIO state incident
  • From: Ofer Shezaf
• Re: [WEB SECURITY] Fwd: OHIO state incident
  • From: TheGesus
• [WEB SECURITY] Research topics
  • From: Pedram Hayati
• [WEB SECURITY] Denim Group Releases Sprajax, an Open Source Security Scanner for AJAX
  • From: bugtraq
• Re: [WEB SECURITY] Fwd: OHIO state incident
  • From: Greenarrow 1
• [WEB SECURITY] Re: Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1
  • From: Amit Klein (AKsecurity)
• [WEB SECURITY] Seeking Volunteers for the WASC Threat Classification v2
  • From: Jeremiah Grossman
• [WEB SECURITY] Misconfigured site, phishing , or bug in Newest firefox???
  • From: Shane Forsythe
• Re: [WEB SECURITY] Misconfigured site, phishing , or bug in Newest firefox???
  • From: Shane Forsythe
• Re: [WEB SECURITY] Misconfigured site, phishing , or bug in Newest firefox???
  • From: Brian Eaton
• Re: [WEB SECURITY] Misconfigured site, phishing , or bug in Newest firefox???
  • From: Brian Eaton
• Re: [WEB SECURITY] Misconfigured site, phishing , or bug in Newest firefox???
  • From: Collin Jackson
• [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: Yash
• Re: [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: Thierry Zoller
• Re: [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: Ryan Barnett
• FW: [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: Yash
• [WEB SECURITY] Write-up by Amit Klein: "IE + some popular forward proxy servers = XSS, defacement (browser cache poisoning)"
  • From: Amit Klein (AKsecurity)
• Re: [WEB SECURITY] Seeking Volunteers for the WASC Threat Classification v2
  • From: Jeremiah Grossman
• [WEB SECURITY] AppSec
  • From: Pete Soderling
• [WEB SECURITY] HTTP Request information
  • From: shadi Aljawarneh
• RE: [WEB SECURITY] HTTP Request information
  • From: dpw
• [WEB SECURITY] Resources on SOA Security
  • From: Gary Smith - SOA Networks
• Re: [WEB SECURITY] another good guy is charged --- What I fear...
  • From: Dennis Groves
• Re: [WEB SECURITY] another good guy is charged --- What I fear...
  • From: Daniel
• Re: [WEB SECURITY] another good guy is charged --- What I fear...
  • From: Daniel
• [WEB SECURITY] Understanding technical vs. logical vulnerabilities
  • From: Jeremiah Grossman
• [WEB SECURITY] Oracle's version of SQL Profiler
  • From: Chris Weber
• RE: [WEB SECURITY] Oracle's version of SQL Profiler
  • From: Aaron C. Newman (AppSecInc)
• [WEB SECURITY] The biggest hacking incident in the web-hosting history
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] The biggest hacking incident in the web-hosting history
  • From: Jason Muskat
• Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: Dinis Cruz
• RE: [WEB SECURITY] another good guy is charged --- What I fear...
  • From: Mark Mcdonald
• [WEB SECURITY] Re: [SC-L] Re: [WEB SECURITY] On sandboxes, and why you should ca re
  • From: leichter_jerrold
• [WEB SECURITY] Re: [SC-L] Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: Andrew van der Stock
• [WEB SECURITY] Automated testing for Authentication Bypass vulnerabilities
  • From: Tech 86
• RE: [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: Matt Fisher
• [WEB SECURITY] Re: [SC-L] Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: George Capehart
• Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: Stephen de Vries
• [WEB SECURITY] RE: [SC-L] Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: Jeff Williams
• RE: [WEB SECURITY] Execution before Authentication Vulnerabilities
  • From: arian.evans
• Re: [WEB SECURITY] RE: [SC-L] Re: [WEB SECURITY] On sandboxes, and why you should care
  • From: Brian Eaton
• [WEB SECURITY] Re: On sandboxes, and why you should care
  • From: Jeff Williams
• [WEB SECURITY] Re: On sandboxes, and why you should care
  • From: Brian Eaton
• [WEB SECURITY] Application Security Hacking Videos
  • From: Joel R. Helgeson
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Daniel
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Tom P Kroll
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Dave King
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Joel R. Helgeson
• [WEB SECURITY] how to find the hole?
  • From: Christian Haus
• Re: [WEB SECURITY] how to find the hole?
  • From: Ryan Barnett
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Chris Weber
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Aiken, Dan
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Andre Maisonneuve
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Aiken, Dan
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Anurag Agarwal
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Glenn.Everhart
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Joel R. Helgeson
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Ivan Ristic
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Andre Maisonneuve
• RE: [WEB SECURITY] Application Security Hacking Videos
  • From: Andre Maisonneuve
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Brian Eaton
• Re: [WEB SECURITY] Application Security Hacking Videos
  • From: Paul Schmehl
• [WEB SECURITY] RE: [OT] Easy Apps ->was->Application Security Hacking Videos
  • From: arian.evans
• [WEB SECURITY] WebScurity ->was-> Application Security Hacking Videos
  • From: arian.evans
• [WEB SECURITY] Apache Coyote/Struts/Tomcat
  • From: Chris Weber
• Re: [WEB SECURITY] WebScurity ->was-> Application Security Hacking Videos
  • From: Joel R. Helgeson
• [WEB SECURITY] Feedback on WebScurity/WAFs ->was->Application Security Hacking Videos
  • From: arian.evans
• Re: [WEB SECURITY] WebScurity ->was-> Application Security Hacking Videos
  • From: Paul Schmehl