Please enable JavaScript.

Coggle requires JavaScript to display documents.

Web 101 (ASCII Code (Unicode (32-bit (2 Billion characters), Represent…

- - - - 2 Billion characters
- - - - form to transfer money
  - - - random token tied to user session
        
        embeded to your site
    - - csrf.js
        $csrf = 'session CSRF token'
        
        baken CSRF token into forms
        
        break include same tag in my own exploit
- - - - secure
        
        Only accessible to HTTPS
      - Http Only
        
        Can't read by javascript
- - - - either in natural language, computer languages or data structures, conforming to the rules of a formal grammar.
      - not just browser
      - web-application firewalls & filters
      - discrepency
        
        vulnerabilities
  - - - script/xss tag
        
        Firefox HTML parser treat slash as whitespace
      - Legacy Parsing
        
        <script> own automatically closed
        at the end of page
        
        exploitable
- - - - no crossing
    - - no wildcarding or subdomain walking
- - - - page content
        
        looks enough like HTML
        parse as HTML
      - IE 6/7-era bugs
        
        Image and text
        
        execute as HTML
    - - site with file upload function
        
        profil pictures
        
        contain enough HTML
        
        trigger sniffing heuristics
        
        Attacker upload picture link it to victims
        
        Fb/other sites use separate domain to host content
      - encoding sniffing
        
        encoding on document
        
        sniffed by (mainly older) browsers
        
        don't specify encoding, browser will apply heuristics
        to determine it.
        
        control the way browser decodes text
        
        alter the parsing
        
        what is unicode 7-bit? & ascii-code???