David Vieira-Kurz

David Vieira-Kurz

@secalert

Webapp Security Researcher. Listed on Adobe/Apple/Ebay/Microsoft/Nokia-Siemens/RedHat/Twitter/VZ security whitehat pages.

Germany · blog.majorsecurity.net

Tweet

  1. 31 Des

    I wish you all a happy new year !

    Bentangkan Ciutkan
  2. 25 Des

    merry xss-mas, everyone.

    Bentangkan Ciutkan
  3. 16 Des

    PwnDizzle: DOM Based XSS in Etsy:

    Bentangkan Ciutkan
  4. 11 Des

    Command Execution In Paypal Worth 5000$:

    Di-retweet oleh
    Bentangkan Ciutkan
  5. 11 Des

    Ebay's Security Team sent me a gift for my continuous support:

    Bentangkan Ciutkan
  6. 3 Des

    Event hijacking due to preventDefault() in JQuery lib:

    Bentangkan Ciutkan
  7. 21 Nov

    I've been also listed on Nokia Siemens Networks Security hall of fame:

    Bentangkan Ciutkan
  8. 19 Nov

    XSS on due to tracking script:

    Bentangkan Ciutkan
  9. 18 Nov

    Exploitable SQL Injection on - details here: CC:

    Bentangkan Ciutkan
  10. 15 Nov

    I was thinking on ex*/*/pression or &equiv in older IE version.

    Bentangkan Ciutkan
  11. 15 Nov

    there's still no solution for s1.php in modern browsers. only for s2.php to s6.php

    Lihat percakapan Sembunyikan percakapan
  12. 15 Nov

    I think your approach on eval.html is well on disabling js by encoding the dot, equal sign and closing round parenthesis. :)

    Lihat percakapan Sembunyikan percakapan
  13. 15 Nov

    your pastebin link is an Unknown Paste ID. can you please upload it once again ?

    Lihat percakapan Sembunyikan percakapan
  14. 14 Nov

    if user-supplied values comes before hidden then in modern browsers hidden has no priority at all.

    Lihat percakapan Sembunyikan percakapan
  15. 14 Nov

    i agree with the order. if hidden comes before any user-supplied argument modern browsers only accepts the first one.

    Lihat percakapan Sembunyikan percakapan
  16. 14 Nov

    see poc here:

    Lihat percakapan Sembunyikan percakapan
  17. 14 Nov

    by using type/ which in xhtml makes type="" out of it and modern browsers takes the first coming type.

    Lihat percakapan Sembunyikan percakapan
  18. 14 Nov

    your welcome :) of course it's okay for me. we have to share knowledge in the sec community.

    Lihat percakapan Sembunyikan percakapan
  19. 14 Nov

    check your DM again :)

    Lihat percakapan Sembunyikan percakapan
  20. 14 Nov

    check your DM for full vector :)

    Lihat percakapan Sembunyikan percakapan

@secalert masih belum menge-tweet.

Pemuatan tampaknya berlangsung agak lama.

Twitter sedang kelebihan beban atau mengalami sedikit masalah. Coba lagi atau kunjungi Status Twitter untuk informasi selengkapnya.