Application Security & Automation

CORS & Same Origin Policy   The same-origin policy is a critical security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin. It helps isolate potentially malicious documents, reducing possible attack vectors. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy XMLHttpRequest   [ Asynchronous requests ] —————————— Use XMLHttpRequest (XHR) objects to interact with servers. You can retrieve data from a URL without having to do a full page refresh. This enables a Web page to update just part of a page without disrupting what the user is doing. XMLHttpRequest is used heavily in AJAX programming. https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest Cors ——— Cross-origin resource sharing (CORS) is a browser mechanism which enables controlled access to resources located outside of a given domain. It extends and adds flexibility to the same-origin policy ( SOP ). However, it a...

Cross Site Request Forgery   Cross site Request forgery leverages trust a website has in the user(or at least the user’s browser) CSRF takes advantage of active session a browser has with the target site: The attack is possible due to predictable parameters on the sensitive transactions An example money transaction user case might have two predictable parameters : Dest account & and Amount CSRF is similar to XSS , but it doesn’t require that the attacker inject code into a web application. CSRF simply leverages the fact that web servers trust the authenticated users, and is possible to pass un-authorized commands from client to there sever without users knowledge.These commands are then executed on server with clients authenticated privileges. Walkthrough   —————— Attacker determines a link to initiate a transaction that uses predictable parameters Attacker posts the link on a site he controls : The site could even be a Facebook page or similar   Or attacker to force ...

Electron Js Security Checklist Disable nodeIntegration for untrusted origins/Do-not Enable Node-Integration Risk  If enabled, nodeIntegration allows JavaScript to leverage Node.js primitives and modules. This could lead to full remote system compromise if you are rendering untrusted content. Auditing nodeIntegration and nodeIntegrationInWorker are boolean options that can be used to determine whether node integration is enabled.  Auditing For BrowserWindow, default is true. If the option is not present, or is set to true/1, nodeIntegration is enabled as in the following examples:  mainWindow = new BrowserWindow({ "webPreferences": { "nodeIntegration": true, “nodeIntegrationInWorker": 1 } });  Or simply:  mainWindow = new BrowserWindow() For webview tag, default is false.  When this attribute is present, the guest page in webview will have node integration: When sanbox is enabled (see below), nodeintegration is disabled. Please note ...

SSRF Notes NOTE :   Wanted to have everything at one place,  these are my reference notes from various bug bounty write ups & security  research, I thank all the authors of the write ups mentioned below  [will update if i find anything interesting] Description In an SSRF attack against the server itself, the attacker induces the  application to make an HTTP request back to the server that is hosting  the application, via its loopback network interface. This will typically  involve supplying a URL with a hostname like 127.0.0.1 (a reserved IP address that points to the loopback adapter) or localhost (a commonly used name for the same adapter).           Many server-side request forgery vulnerabilities are relatively easy to  spot, because the application's normal traffic involves request  parameters containing full URLs Blind SSRF Blind SSRF vulnerabilities arise...

Introduction Monitoring Network Traffic for malicious activities is one of the priorities for an network IDS, what if the network IDS can take in threat intelligence data to look out for malicious domains, Ip addresses, emails,file-hashes and so on, sagan has one such feature called Bro intelligence framework this write up  will give you an insight on how to install configure and use bro intel framework in sagan. I have been working with sagan for few months now, it has been really hard to put all the pieces together and you don't really find any perfect documentation or tutorials regarding sagan and its features at one place. Sagan is an open source real time log analysis and correlation engine that runs on Unix Operating Systems, sagan's rules are quite similar to SNORT. Sagan can record events to the snort unified 2 output format which allows it to be compatible with user interfaces such as Squil,Snorby,Graylog. Sagan has lot more capabilities than being a Log Anal...