SecurityFeed.info » Web App Security (webappsec) Mailing List

Feeds

28634 items (28634 unread) in 97 feeds

• Aviv Raff On .NET (22 unread)
• Bugtraq (bugtraq) Mailing List (697 unread)
• CGISecurity.com: Your Web Site and Application Security Resource (125 unread)
• christian's weblog (25 unread)
• Irongeek's Security Site (159 unread)
• Jeremiah Grossman (85 unread)
• Heorot.net (13 unread)
• milw0rm.com (520 unread)
• Nmap Hackers (nmap-hackers) Mailing List (9 unread)
• Packet Storm Security Advisories (440 unread)
• Packet Storm Security Exploits (541 unread)
• Packet Storm Security Headlines (450 unread)
• Packet Storm Security Last 100 (2496 unread)
• Packet Storm Security Last 20 (993 unread)
• Packet Storm Security Last 50 (1803 unread)
• Packet Storm Security Last Files (624 unread)
• Packet Storm Security Miscellaneous Files (162 unread)
• Packet Storm Security Tools (174 unread)
• Rootsecure.net (819 unread)
• SecuriTeam.com (262 unread)
• Security Vulnerability Research & Defense (47 unread)
• SecurityFocus News (173 unread)
• SecurityFocus Vulnerabilities (868 unread)
• Securityvulns news channel (407 unread)
• SecWatch - Latest Exploit Alerts (10 unread)
• Taking Network Security to the Streets (28 unread)
• The One And Only Matt Parnell.com (38 unread)
• The Register - Security (594 unread)
• The Register - Software (663 unread)
• VulnWatch (vulnwatch) Mailing List (19 unread)
• Web App Security (webappsec) Mailing List (118 unread)
• IceСμbeς (15 unread)
• Linmagazine (281 unread)
• ‫netcraft Bytes :) (47 unread)
• Digg (4381 unread)
• Blonde 2.0 (68 unread)
• The Microsoft Security Response Center (MSRC) (59 unread)
• (IN)SECURE Magazine Notifications RSS (18 unread)
• 0x000000 Security (95 unread)
• ----- Anti-Malware ----- Analysis and Defense (16 unread)
• Apple Fun (25 unread)
• Technorati Search for: aviv.raffon.net (263 unread)
• C.I.S.R.T. (10 unread)
• Determina Zero-Day Protection (6 unread)
• Didier Stevens (67 unread)
• eEye Digital Security - Research Blog (10 unread)
• Ryan Naraine's Security Watch (153 unread)
• Security - RSS Feeds (265 unread)
• Exploit Prevention Labs (28 unread)
• Software Vulnerability Exploitation Blog (22 unread)
• F-Secure Antivirus Research Weblog (109 unread)
• Full Disclosure (300 unread)
• George Ou (10 unread)
• GNUCITIZEN Media Portfolio (96 unread)
• ha.ckers.org web application security lab (43 unread)
• heise security (468 unread)
• invisiblethings' blog (35 unread)
• Jeff Jones's blog (12 unread)
• JScript Blog (18 unread)
• Matasano Chargen (43 unread)
• McAfee Avert Labs (89 unread)
• Michael Howard's Web Log (37 unread)
• PandaLabs (52 unread)
• Zero Day (333 unread)
• SANS Internet Storm Center, InfoCON: green (287 unread)
• Latest Secunia Security Watchdog Blog Entries (32 unread)
• SecuriTeam Blogs (85 unread)
• Security Fix (163 unread)
• HP ASC Portal (30 unread)
• Strike Center (12 unread)
• Sunbelt Blog (296 unread)
• Sunnet Beskerming Security Advisories (45 unread)
• Technobabylon
• The Recurity Lablog (33 unread)
• Wired: Threat Level (626 unread)
• TrendLabs | Malware Blog - by Trend Micro (213 unread)
• Uninformed Journal (49 unread)
• WabiSabiLabi's blog (23 unread)
• WatchGuard Wire (58 unread)
• Latest Blog Entires From WebSense Security Labs (67 unread)
• Hackszine.com (215 unread)
• DVLabs: Blogs (79 unread)
• Errata Security (90 unread)
• Robert Hensing's Blog (91 unread)
• PaulDotCom Community Blog (12 unread)
• David LeBlanc's Web Log (24 unread)
• Billy (BK) Rios (23 unread)
• David Litchfield's blog (21 unread)
• Farfromr00tin (23 unread)
• aut disce, aut discede (17 unread)
• pwn* (16 unread)
• hackademix.net (54 unread)
• SecurityDot Vulnerabilities (525 unread)
• Vulnerabilities & Exploits (37 unread)
• Malicious Code (33 unread)
• Security Risks (22 unread)
• Digg / Security / upcoming (4475 unread)

Web App Security (webappsec) Mailing List (10 unread)

• November 04, 2008
• 12:53

  Re: A Question of Quality

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Daniël W. Crompton on Nov 4

  2008/11/2 Robert Hajime Lanning <robert.lanning_at_gmail.com>:
  > On Thu, Oct 30, 2008 at 4:55 PM, Yousef Syed <yousef.syed_at_gmail.com> wrote:
  >> Why isn't Quality Assumed?
  >> Why isn't Security Assumed?
  >> Why are these concepts thought of as add ons...

• 1:26

  Re: A Question of Quality

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Yousef Syed on Nov 4

  Hi Marco, All,
  I think the first time that I really got into the whole quality at the
  code level was waay back in 2000 when I was involved in my first
  Extreme Programming project.
  It was mandated that all methods follow Design by Contract
  (http://en.wikipedia.org/wiki/Design_by_contract), so...

• November 03, 2008
• 17:29

  New Whitepaper - quotContinuing Business with Malware Infected Customersquot

   » ‎ Web App Security (webappsec) Mailing List
  Posted by WebAppSec on Nov 3

  Hi List,
  

  I figured I'd try sharing a new paper I completed and posted to my site
  yesterday.
  

  The paper is based off some of the work I've been discussing at various
  conferences recently in relation to the man-in-the-browser attack vectors,
  and their effect on financial Web applications - in...

• 16:23

  CSRF attacks against OAuth

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Jake Spekle on Nov 3

  I came across this blog post this morning and thought it was
  interesting and worth posting here:
  

  http://blog.cliqset.com/2008/11/02/csrf-and-oauth/
  

  Considering what OAuth is designed for, it seems like CSRF attacks
  against it could prove to be quite fruitful for an attacker.
  

  -
  JS
  

  ...

• November 02, 2008
• 21:24

  Re: A Question of Quality

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Robert Hajime Lanning on Nov 2

  On Thu, Oct 30, 2008 at 4:55 PM, Yousef Syed <yousef.syed_at_gmail.com> wrote:
  > Why isn't Quality Assumed?
  > Why isn't Security Assumed?
  > Why are these concepts thought of as add ons to Applications and Services?
  >
  > Why do they need to be specified, when they...

• 14:00

  The Month of Burp Pr0n

   » ‎ Web App Security (webappsec) Mailing List
  Posted by PortSwigger on Nov 2

  Users of Burp Suite will no doubt be pleased to learn that work on the next
  version is at an advanced stage, and this is scheduled for release in
  December. This will be a major upgrade with numerous enhancements to
  existing tools, and the addition of some brand new ones.
  

  Every day during...

• October 31, 2008
• 3:55

  A Question of Quality

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Yousef Syed on Oct 31

  Why isn't Quality Assumed?
  Why isn't Security Assumed?
  Why are these concepts thought of as add ons to Applications and Services?
  

  Why do they need to be specified, when they should be taken for granted?
   - Input Validation
   - Boundary Conditions
   - Encrypt Data as necessary
  ...

• October 28, 2008
• 4:13

  FINAL NOTICE: OWASP Portugal EU Summit

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Dave Wichers on Oct 27

  It’s almost here….one of the most important events in OWASP history, the 2008 Summit!
  
  http://www.owasp.org/index.php/OWASP_EU_Summit_2008
  
  OWASP Summit EU 2008 is a worldwide gathering of OWASP leaders and key industry
  players to present and discuss the latest OWASP tools and...

• October 27, 2008
• 15:41

  ClubHack2008 [India] - CFP Closing Soon

   » ‎ Web App Security (webappsec) Mailing List
  Posted by ClubHack on Oct 27

  This is a gentle reminder that the Call for Papers for ClubHack2008 is
  closing on the 10th of November.
  URL: http://clubhack.com/2008/CFP
  

  Papers are expected to be of 40 minutes each. The schedule time for
  each presenter would be 50 minutes out of which 40 minutes are for the
  presentation...

• October 22, 2008
• 9:34

  Script Tag Breakout

   » ‎ Web App Security (webappsec) Mailing List
  Posted by Nick Von Dadelszen on Oct 22

  That makes sense from a parsing flow. Problem is that not many coders
  I've seen think about this, and I hadn't seen it documented anywhere
  so worth a discussion at least.
  

  On Wed, Oct 22, 2008 at 6:38 AM, Stefano Di Paola
  <stefano.dipaola_at_mindedsecurity.com> wrote:
  > The...