Top Ten Web Hacking Techniques of 2011

This post will serve to collect new attack techniques as they are published. If you think something should be added, please comment below and I'll add them.

"Every year the Web security community produces a stunning amount of new hacking techniques published in various white papers, blog posts, magazine articles, mailing list emails, etc. Within the thousands of pages are the latest ways to attack websites, Web browsers, Web proxies, and so on. Beyond individual vulnerability instances with CVE numbers or system compromises, we're talking about actual new and creative methods of Web-based attack. The Top Ten Web Hacking Techniques list encourages information sharing, provides a centralized knowledge-base, and recognizes researchers who contribute excellent work."

Current 2011 List

1. Bypassing Flash’s local-with-filesystem Sandbox
2. Abusing HTTP Status Codes to Expose Private Information
3. SpyTunes: Find out what iTunes music someone else has
4. CSRF: Flash + 307 redirect = Game Over
5. Close encounters of the third kind (client-side JavaScript vulnerabilities)

Read more: Jeremiah Grossman

Posted via email from Jasper-net