The Web Security Mailing List (2008 July)

• Thread Index

• [WEB SECURITY] CFP 25C3 - The 25th Chaos Communication Congress 2008
  • From: fukami
• [WEB SECURITY] Header information
  • From: Ricky
• [WEB SECURITY] New Paper: More than 600 million users surf at high risk
  • From: Stefan Frei
• Re: [WEB SECURITY] Header information
  • From: Chris Patten
• RE: [WEB SECURITY] Header information
  • From: Brian Shura
• [WEB SECURITY] [tool] ratproxy - passive web application security assessment tool
  • From: Michal Zalewski
• [WEB SECURITY] Flash Movies Describing Security Bugs
  • From: Sebastian Schinzel
• [WEB SECURITY] Microsoft Blog Outlines IE8 Security Changes
  • From: robert
• [WEB SECURITY] several IE8 features controversial at best "Onward to Beta-2 in August!"
  • From: Mat Caughron
• Re: [WEB SECURITY] several IE8 features controversial at best "Onward to Beta-2 in August!"
  • From: kuza55
• [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: Ray Foo
• RE: [WEB SECURITY] several IE8 features controversial at best "Onward to Beta-2 in August!"
  • From: Chris Weber \(Casaba Security\)
• Re: [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: Zinho
• [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Ryan Barnett
• Re: [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: JEaton
• [WEB SECURITY] RE: [Webappsec] Comparisons of Web Application Firewalls
  • From: Matthew Presson
• Re: [WEB SECURITY] thoughts on WAF deployment options?
  • From: Ivan Ristic
• Re: [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: Marcin Wielgoszewski
• RE: [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: Brian Shura
• Re: [WEB SECURITY] Comparisons of Web Application Firewalls
  • From: bugtraq
• [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Arian J. Evans
• Re: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Ory Segal
• [WEB SECURITY] [Off Topic] Judge Orders YouTube to Give All User Histories to Viacom
  • From: Joe White
• [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Stephen Craig Evans
• RE: [WEB SECURITY] [Off Topic] Judge Orders YouTube to Give All User Histories to Viacom
  • From: Rafal Los
• RE: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Martin O'Neal
• Re: [WEB SECURITY] [Off Topic] Judge Orders YouTube to Give All User Histories to Viacom
  • From: Stephan Wehner
• Re: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Arian J. Evans
• Re: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Ryan Barnett
• RE: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Martin O'Neal
• Re: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Achim
• Re: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Arian J. Evans
• [WEB SECURITY] Announcing WAFReviews.com
  • From: Joe White
• [WEB SECURITY] SNS08-01 Whitepaper - SE Automated Scanning Anomaly - Google Dork Failure
  • From: AKS aka (0kn0ck)
• RE: [WEB SECURITY] SNS08-01 Whitepaper - SE Automated Scanning Anomaly - Google Dork Failure
  • From: Michael S. Menefee
• Re: [WEB SECURITY] SNS08-01 Whitepaper - SE Automated Scanning Anomaly - Google Dork Failure
  • From: AKS aka (0kn0ck)
• RE: [WEB SECURITY] Re: [Webappsec] Comparisons of Web Application Firewalls
  • From: Martin O'Neal
• [WEB SECURITY] Re: [Webappsec] [WEB SECURITY] Re: Comparisons of Web Application Firewalls
  • From: Jim Manico
• [WEB SECURITY] Re: [Webappsec] [WEB SECURITY] Re: Comparisons of Web Application Firewalls
  • From: Ernest Mueller
• [WEB SECURITY] Re: [Webappsec] [WEB SECURITY] Re: Comparisons of Web Application Firewalls
  • From: Jim Manico
• [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Arshan Dabirsiaghi
• [WEB SECURITY] Re: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Arian J. Evans
• Re: [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Achim
• RE: [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Arshan Dabirsiaghi
• RE: [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ernest Mueller
• [WEB SECURITY] [Tool] - ProxyStrike v2.0 - Active Web application proxy
  • From: Christian Martorella
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Achim
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Achim
• Re: [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Rohit Lists
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Brian Shura
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Facundo Batista
• Re: [WEB SECURITY] RE: [Webappsec] [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Rafal @ IsHackingYou
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Rafal @ IsHackingYou
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Jeremiah Grossman
• [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Colin Watson
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ivan Ristic
• [WEB SECURITY] Major DNS Vulnerabilities
  • From: robert
• RE: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Michael S. Menefee
• RE: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Michael S. Menefee
• Re: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Johannes B. Ullrich, Ph.D.
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Licky Lindsay
• Re: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Mike Fratto
• Re: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Amit Klein
• Re: [WEB SECURITY] Major DNS Vulnerabilities
  • From: Joe White
• [WEB SECURITY] Ways To Identify Returning Web Visitors
  • From: James Hatcher
• Re: [WEB SECURITY] Ways To Identify Returning Web Visitors
  • From: Nathanael Hoyle
• Re: [WEB SECURITY] Ways To Identify Returning Web Visitors
  • From: Andy Steingruebl
• [WEB SECURITY] what are the rules for SSNs?
  • From: Licky Lindsay
• RE: [WEB SECURITY] what are the rules for SSNs?
  • From: Schmidt, Albert E
• Re: [WEB SECURITY] what are the rules for SSNs?
  • From: Johannes B. Ullrich, Ph.D.
• RE: [WEB SECURITY] what are the rules for SSNs?
  • From: Schmidt, Albert E
• RE: [WEB SECURITY] what are the rules for SSNs?
  • From: Glenn.Everhart
• Re: [WEB SECURITY] Ways To Identify Returning Web Visitors
  • From: Bil Corry
• RE: [WEB SECURITY] what are the rules for SSNs?
  • From: Lavery, Oliver
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Sebastien Deleersnyder
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ofer Shezaf
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Andres Riancho
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Sebastien Deleersnyder
• Re: [WEB SECURITY] what are the rules for SSNs?
  • From: Mat Caughron
• Re: [WEB SECURITY] what are the rules for SSNs?
  • From: Morrow Long
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Rafal @ IsHackingYou
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Martin O'Neal
• [WEB SECURITY] Please review: XSS Defense HOWTO
  • From: Ivan Ristic
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ivan Ristic
• Re: [WEB SECURITY] Please review: XSS Defense HOWTO
  • From: Andy Steingruebl
• Re: [WEB SECURITY] Please review: XSS Defense HOWTO
  • From: Ivan Ristic
• Re: [WEB SECURITY] what are the rules for SSNs?
  • From: Joe White
• RE: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ofer Shezaf
• [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• [WEB SECURITY] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Prasad Shenoy
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Prasad Shenoy
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Ryan Barnett
• Re: [WEB SECURITY] Nice little XSS trick
  • From: James Landis
• [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Jim Manico
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Prasad Shenoy
• RE: [WEB SECURITY] Nice little XSS trick
  • From: Gabriel Kälin
• Re: [WEB SECURITY] Nice little XSS trick
  • From: James Landis
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Rodney Gladue
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Nathanael Hoyle
• [WEB SECURITY] Oracle Application Server PLSQL injection flaw
  • From: David Litchfield
• RE: [WEB SECURITY] Nice little XSS trick
  • From: White, Dain P
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Jim Manico
• Re: [WEB SECURITY] Nice little XSS trick
  • From: James Landis
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Nathanael Hoyle
• [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Andy Steingruebl
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Bil Corry
• [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: silky
• [WEB SECURITY] Call for Participation - CIS MOSS 2007 and Tomcat 5.5/6.x Security Configuration Guides
  • From: Blake Frantz
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• RE: [WEB SECURITY] Nice little XSS trick
  • From: Gabriel Kälin
• [WEB SECURITY] Paper draft: Enough With Default Allow in Web Applications!
  • From: Ivan Ristic
• [WEB SECURITY] Auditing mailing scripts for web app pentesters
  • From: Adrian Pastor
• [WEB SECURITY] RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• [WEB SECURITY] RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• RE: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• [WEB SECURITY] RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: silky
• [WEB SECURITY] RE: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Martin O'Neal
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Licky Lindsay
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Amit Klein
• RE: [WEB SECURITY] Nice little XSS trick
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Bil Corry
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Bill Pennington
• Re: [WEB SECURITY] Re: [Webappsec] Corsaire whitepaper: Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
  • From: Terrence Enger
• Re: [WEB SECURITY] Nice little XSS trick
  • From: David Byrne
• RE: [WEB SECURITY] Nice little XSS trick
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] Nice little XSS trick
  • From: James Landis
• Re: [WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls
  • From: Ivan Ristic
• [WEB SECURITY] slow, deliberate ftp probes
  • From: Greg
• Re: [WEB SECURITY] slow, deliberate ftp probes
  • From: Bil Corry
• RE: [WEB SECURITY] Nice little XSS trick
  • From: Arshan Dabirsiaghi
• [WEB SECURITY] ActivePerl
  • From: jfvanmeter
• Re: [WEB SECURITY] Nice little XSS trick
  • From: James Landis
• Re: [WEB SECURITY] Paper draft: Enough With Default Allow in Web Applications!
  • From: Colin Watson
• Re: [WEB SECURITY] Nice little XSS trick
  • From: Jeremiah Grossman
• [WEB SECURITY] Security Vacation Guide
  • From: Pete Herzog
• [WEB SECURITY] Lateral SQL Injection Revisited - No Special Privs Required
  • From: David Litchfield
• Re: [WEB SECURITY] ActivePerl
  • From: jfvanmeter
• [WEB SECURITY] cross site trace
  • From: Raymond Forbes
• [WEB SECURITY] Web Application Security Professionals Survey (July 2008)
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] cross site trace
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] cross site trace
  • From: James Landis
• Re: [WEB SECURITY] cross site trace
  • From: Raymond Forbes
• [WEB SECURITY] Abusing HTML 5 Structured Client-side Storage
  • From: Alberto Trivero
• Re: [WEB SECURITY] cross site trace
  • From: James Landis
• Re: [WEB SECURITY] cross site trace
  • From: Ory Segal
• RE: [WEB SECURITY] cross site trace
  • From: Brian Shura
• Re: [WEB SECURITY] cross site trace
  • From: Amit Klein
• Re: [WEB SECURITY] cross site trace
  • From: Raymond Forbes
• RE: [WEB SECURITY] cross site trace
  • From: Martin O'Neal
• Re: [WEB SECURITY] cross site trace
  • From: Arian J. Evans
• RE: [WEB SECURITY] cross site trace
  • From: Brian Shura
• Re: [WEB SECURITY] cross site trace
  • From: Adrian Pastor
• Re: [WEB SECURITY] cross site trace
  • From: James Landis
• [WEB SECURITY] Re: OT URLScan was [WEB SECURITY] cross site trace
  • From: Arian J. Evans
• RE: [WEB SECURITY] cross site trace
  • From: Brian Shura
• RE: [WEB SECURITY] cross site trace
  • From: Tom Brennan
• RE: [WEB SECURITY] cross site trace
  • From: Tom Brennan
• RE: [WEB SECURITY] cross site trace
  • From: Martin O'Neal
• [WEB SECURITY] LifeCycleSecurity offer to WASC community
  • From: Dennis Hurst
• [WEB SECURITY] XSS/injection/... evading technique
  • From: Nick Gearls
• RE: [WEB SECURITY] cross site trace
  • From: Martin O'Neal
• Re: [WEB SECURITY] Paper draft: Enough With Default Allow in Web Applications!
  • From: Ivan Ristic
• [WEB SECURITY] Administrative: Mail Server Issues
  • From: robert
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Jon McClintock
• Re: [WEB SECURITY] Security testing
  • From: Matthew Chalmers
• Re: [WEB SECURITY] Flash Movies Describing Security Bugs
  • From: Matthew Chalmers
• RE: [WEB SECURITY] Security testing
  • From: Arshan Dabirsiaghi
• RE: [WEB SECURITY] Security testing
  • From: Tom Brennan
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Arian J. Evans
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Jon McClintock
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Arian J. Evans
• RE: [WEB SECURITY] XSS/injection/... evading technique
  • From: Arshan Dabirsiaghi
• [WEB SECURITY] Information Security Events in North America
  • From: Garrett Gee
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Ivan Ristic
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Marc Stern
• RE: [WEB SECURITY] XSS/injection/... evading technique
  • From: Arshan Dabirsiaghi
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Ivan Ristic
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Ryan Barnett
• Re: [WEB SECURITY] XSS/injection/... evading technique
  • From: Nick Gearls
• Re: [WEB SECURITY] Web Application Security Professionals Survey (July 2008)
  • From: Jeremiah Grossman
• Re: [WEB SECURITY] quick question on password reset 'best practices'
  • From: Matthew Chalmers
• [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Sharevane
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Craig Ingram
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Justin Thomas
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Joe White
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Matthew Chalmers
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Sharevane
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: clintwill
• Re: [WEB SECURITY] Do we need desktop admin rights for webapplication penetration testing?
  • From: Gleb Paharenko
• [WEB SECURITY] Db2 hacking
  • From: Sharevane
• Re: [WEB SECURITY] Db2 hacking
  • From: Steve Pinkham
• Re: [WEB SECURITY] Db2 hacking
  • From: zer0x90
• Re: [WEB SECURITY] Db2 hacking
  • From: edjenguele christian eric
• [WEB SECURITY] Re: The Great WAF Debate --was--> XSS/injection/... evading technique
  • From: Arian J. Evans
• RE: [WEB SECURITY] Re: The Great WAF Debate --was--> XSS/injection/... evading technique
  • From: Martin O'Neal
• [WEB SECURITY] Whitepaper - Behind Enemy Lines: Administrative Web Application Attacks
  • From: Rafael Dominguez-Vega
• Re: [WEB SECURITY] IP address change: relogin
  • From: Jason Muskat
• Re: [WEB SECURITY] Certification CEH, CPT or SANS GIAC GPEN
  • From: Jason Muskat de VE3TSJ, GCFA, GCUX, CEI, CEH
• Re: [WEB SECURITY] IP address change: relogin
  • From: clintwill
• RE: [WEB SECURITY] IP address change: relogin
  • From: Martin O'Neal
• Re: [WEB SECURITY] IP address change: relogin
  • From: Esam Gharish
• RE: [WEB SECURITY] IP address change: relogin
  • From: Martin O'Neal
• Re: [WEB SECURITY] IP address change: relogin
  • From: Jason Muskat de VE3TSJ, GCFA, GCUX, CEI, CEH