The Web Security Mailing List (2008 June)

• Thread Index

• RE: [WEB SECURITY] Question about escaping strings in javascript
  • From: Chris Weber \(Casaba Security\)
• [WEB SECURITY] quick question on password reset 'best practices'
  • From: Joe White
• RE: [WEB SECURITY] quick question on password reset 'best practices'
  • From: White, Dain P
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Rafal @ IsHackingYou
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Stephen de Vries
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: James Landis
• Re: [WEB SECURITY] Question about escaping strings in javascript
  • From: Arian J. Evans
• [WEB SECURITY] Testing Microsoft Smart Clients [may be OT]
  • From: Prasad Shenoy
• [WEB SECURITY] Knowing what's plugged-in?
  • From: Jon Kibler
• [WEB SECURITY] question about anti-xss applicability of PHP's htmlentities()
  • From: Eric Stein
• [WEB SECURITY] AccessMe Tool Now Available
  • From: Oliver Lavery
• Re: [WEB SECURITY] Knowing what's plugged-in?
  • From: Bil Corry
• Re: [WEB SECURITY] AccessMe Tool Now Available
  • From: Andre Gironda
• Re: [WEB SECURITY] question about anti-xss applicability of PHP's htmlentities()
  • From: Marcin Wielgoszewski
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Colin Watson
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Pete Herzog
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Colin Watson
• RE: [WEB SECURITY] quick question on password reset 'best practices'
  • From: White, Dain P
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: bugtraq
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Pete Herzog
• [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Arian J. Evans
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Arian J. Evans
• RE: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Adam Muntner
• RE: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Arian J. Evans
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Jeff Robertson
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Oliver Lavery
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Rafal @ IsHackingYou.com
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Sebastian Schinzel
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Stephen de Vries
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Jeff Robertson
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Jeremiah Grossman
• RE: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Martin O'Neal
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Marcin Wielgoszewski
• Re: [WEB SECURITY] HTTP Verb Tampering for Dummies
  • From: Jeff Robertson
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Sebastian Schinzel
• [WEB SECURITY] XSS Help
  • From: GsNaseer Gs
• Re: [WEB SECURITY] XSS Help
  • From: romain
• Re: [WEB SECURITY] XSS Help
  • From: Mike Duncan
• Re: [WEB SECURITY] XSS Help
  • From: Ryan Barnett
• RE: [WEB SECURITY] XSS Help
  • From: Hoffman, Billy
• RE: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Martin O'Neal
• Re: [WEB SECURITY] Question about escaping strings in javascript
  • From: Evert | Collab
• [WEB SECURITY] CSRF Help
  • From: GsNaseer Gs
• Re: [WEB SECURITY] CSRF Help
  • From: Bipin Upadhyay
• Re: [WEB SECURITY] CSRF Help
  • From: bugtraq
• Re: [WEB SECURITY] CSRF Help
  • From: Neil Daswani
• Re: [WEB SECURITY] CSRF Help
  • From: Zinho
• Re: [WEB SECURITY] CSRF Help
  • From: Arian J. Evans
• Re: [WEB SECURITY] CSRF Help
  • From: Rimantas Liubertas
• [WEB SECURITY] http header or javascript
  • From: application.secure application.secure
• Re: [WEB SECURITY] http header or javascript
  • From: Marcin Wielgoszewski
• Re: [WEB SECURITY] http header or javascript
  • From: Marcin Wielgoszewski
• RE: [WEB SECURITY] http header or javascript
  • From: Martin O'Neal
• RE: [WEB SECURITY] http header or javascript
  • From: Johnson, Eric
• [WEB SECURITY] XSS Script
  • From: Feroz Salman
• [WEB SECURITY] Vulnerability Disclosure in University
  • From: Michele Orru'
• Re: [WEB SECURITY] XSS Script
  • From: Mike Duncan
• RE: [WEB SECURITY] Vulnerability Disclosure in University
  • From: steve jensen
• Re: [WEB SECURITY] Vulnerability Disclosure in University
  • From: Michele Orru'
• [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Katie Riley
• RE: [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Jenkinson, John P (SAIC)
• Re: [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Shyaam
• Re: [WEB SECURITY] XSS Script
  • From: Glafkos - InfoSEC \(Information Security Uncensored\)
• RE: [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Mark Roxberry
• RE: [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Jenkinson, John P (SAIC)
• [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Carlos
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Amit Klein
• RE: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Michael S. Menefee
• RE: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Michael S. Menefee
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Amit Klein
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Amit Klein
• [WEB SECURITY] ModSecurity Session Fixation rules
  • From: Michele Orru'
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Bil Corry
• Re: [WEB SECURITY] ModSecurity Session Fixation rules
  • From: Ryan Barnett
• [WEB SECURITY] ASP.NET 3.5 Request Validation
  • From: Michael S. Menefee
• RE: [WEB SECURITY] ASP.NET 3.5 Request Validation
  • From: Eric Rachner
• RE: [WEB SECURITY] ASP.NET 3.5 Request Validation
  • From: Michael S. Menefee
• RE: [WEB SECURITY] ASP.NET 3.5 Request Validation
  • From: Mark Roxberry
• [WEB SECURITY] LifeCycleSecurity Conference 2008 - Call for Presentations
  • From: Dennis Hurst
• [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: wilke rodriquez
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Christian Frichot
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Michele Orru'
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Bil Corry
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Mike Fratto
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Licky Lindsay
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Mike Fratto
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Dinis Cruz
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: jfvanmeter
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Tom Stripling
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: James Landis
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: James Landis
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Michele Orru'
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Paul Schmehl
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Michele Orru'
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: jfvanmeter
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Mike Fratto
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Mike Fratto
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Josh Amishav-Zlatin
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Michele Orru'
• [Fwd: Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?]
  • From: Michele Orru'
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Lavery, Oliver
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: James Landis
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Bil Corry
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Smolsky, Shawn J
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Rohit Lists
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Rohit Lists
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Paul Schmehl
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Mike Fratto
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Licky Lindsay
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Bil Corry
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: wilke rodriquez
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Chris Varenhorst
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Christian Frichot
• [WEB SECURITY] JavaScript Code Flow Manipulation & Adobe Flex 3 DOM-based XSS Vulnerability
  • From: Ory Segal
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• [WEB SECURITY] The Extended HTML Form attack revisited
  • From: Sandro Gauci
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Ivan Ristic
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Nathanael Hoyle
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Arian J. Evans
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Oliver Lavery
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: James Landis
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Ivan Ristic
• [WEB SECURITY] Save the date- Breach Security, OWASP & WASC Cocktail party at BlackHat 08
  • From: Heather Cason
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Alex Stamos
• [WEB SECURITY] Re: [Full-disclosure] The Extended HTML Form attack revisited
  • From: kuza55
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Albert Lunde
• RE: [WEB SECURITY] The Extended HTML Form attack revisited
  • From: Michael S. Menefee
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Oliver Lavery
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Oliver Lavery
• Re: [WEB SECURITY] The Extended HTML Form attack revisited
  • From: Sandro Gauci
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Ivan Ristic
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Ivan Ristic
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Ivan Ristic
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Alex Stamos
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: James Landis
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Arian J. Evans
• RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Martin O'Neal
• [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Lavery, Oliver
• Re: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Evan Arians
• RE: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Martin O'Neal
• Re: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Arian J. Evans
• Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
  • From: Rafal @ IsHackingYou.com
• Re: [WEB SECURITY] Hashing and entropy
  • From: Oliver Lavery
• Re: [WEB SECURITY] Hashing and entropy
  • From: Bil Corry
• RE: [WEB SECURITY] Hashing and entropy
  • From: Martin O'Neal
• Re[2]: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Thierry Zoller
• Re: Re[2]: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Rohit Lists
• RE: Re[2]: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: Dave Sanford
• Re: [WEB SECURITY] Hashing and entropy (was RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?)
  • From: ascii
• Re: [WEB SECURITY] Hashing and entropy
  • From: Nathanael Hoyle
• Re: [WEB SECURITY] Hashing and entropy
  • From: Amit Klein
• RE: [WEB SECURITY] Hashing and entropy
  • From: Glenn.Everhart
• [WEB SECURITY] Troll post to the WASC list using my name
  • From: Arian J. Evans
• Re: [WEB SECURITY] HTTP cache poisoning via Host header injection
  • From: Bil Corry
• RE: [WEB SECURITY] Hashing and entropy
  • From: Lavery, Oliver
• RE: [WEB SECURITY] Hashing and entropy
  • From: Martin O'Neal
• Re: [WEB SECURITY] Hashing and entropy
  • From: Nathanael Hoyle
• RE: [WEB SECURITY] Hashing and entropy
  • From: Lavery, Oliver
• Re: [WEB SECURITY] Hashing and entropy
  • From: Michel Arboi
• [WEB SECURITY] Javascript Malware
  • From: Mailvaganam, Hari
• RE: [WEB SECURITY] Hashing and entropy
  • From: Lavery, Oliver
• RE: [WEB SECURITY] Hashing and entropy
  • From: Lavery, Oliver
• [WEB SECURITY] Re: [Full-disclosure] The Extended HTML Form attack revisited
  • From: Sandro Gauci
• [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Hoffman, Billy
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Michael S. Menefee
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Zinho
• Re: [WEB SECURITY] Javascript Malware
  • From: Bil Corry
• RE: [WEB SECURITY] Javascript Malware
  • From: Bemis,Brian M
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Bryan Sullivan
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Rafal @ IsHackingYou
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Hoffman, Billy
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Michael S. Menefee
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Rafal @ IsHackingYou
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Hoffman, Billy
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: kuza55
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Oliver Lavery
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Zinho
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Zinho
• [WEB SECURITY] Security testing
  • From: Syed Kabeer Ahmed
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Sven Vetsch / Disenchant
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Hoffman, Billy
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Curt Wilson
• RE: [WEB SECURITY] Security testing
  • From: Spires, Bucky
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Chris Eng
• Re: [WEB SECURITY] Security testing
  • From: Bil Corry
• RE: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Mark Roxberry
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Zinho
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: romain
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Zinho
• Re: [WEB SECURITY] Announcing Scrawlr: SQL Injector and Crawler
  • From: Paul Schmehl
• [WEB SECURITY] OWASP 2008 USA, NYC
  • From: Tom Brennan
• [WEB SECURITY] ICANN Approves new top-level domains
  • From: robert
• Re: [WEB SECURITY] ICANN Approves new top-level domains
  • From: romain
• Re: [WEB SECURITY] ICANN Approves new top-level domains
  • From: kuza55
• [WEB SECURITY] Stanford Emerging Threats and Defenses Symposium
  • From: Neil Daswani