WebApp Sec: by thread

WebApp Sec: by thread

Previous period

308 messages starting Jul 01 03 and ending Sep 26 03
Date index | Thread index | Author index

Tool like IISLockdown or URLScan John Madden (Jul 01)
- RE: Tool like IISLockdown or URLScan owasp (Jul 01)
- <Possible follow-ups>
- RE: Tool like IISLockdown or URLScan Arek Slominski (Jul 01)
  - RE: Tool like IISLockdown or URLScan dave (Jul 01)
- RE: Tool like IISLockdown or URLScan Dawes, Rogan (ZA - Johannesburg) (Jul 01)
- Re: Tool like IISLockdown or URLScan lbrlove (Jul 01)
- RE: Tool like IISLockdown or URLScan Chris Neppes (Jul 01)
- RE: Tool like IISLockdown or URLScan Renato E. Gioielli Andalik (Jul 01)
- RE: Tool like IISLockdown or URLScan Ben Krueger (Jul 01)
no standards for webapp exploitation ned (Jul 02)
- <Possible follow-ups>
- RE: no standards for webapp exploitation Dawes, Rogan (ZA - Johannesburg) (Jul 02)
- Re: no standards for webapp exploitation Ingo Struck (Jul 02)
  - Re: no standards for webapp exploitation dave (Jul 02)
How to protect against cookie stealing? Phil Cox (Jul 24)
- Re: How to protect against cookie stealing? Brant Langer Gurganus (Jul 24)
- Re: How to protect against cookie stealing? Bill Pennington (Jul 24)
- Re: How to protect against cookie stealing? Marc Slemko (Jul 27)
- <Possible follow-ups>
- RE: How to protect against cookie stealing? Dawes, Rogan (ZA - Johannesburg) (Jul 24)
  - RE: How to protect against cookie stealing? .:[ Death Star]:. (Jul 24)
    - Re: How to protect against cookie stealing? Chris Green (Jul 26)
    - Re: How to protect against cookie stealing? Erik Kangas, PhD (Jul 26)
- RE: How to protect against cookie stealing? Ingo Struck (Jul 24)
  - RE: How to protect against cookie stealing? Gabriel Lawrence (Jul 27)
- Re: How to protect against cookie stealing? Mark Reardon (Jul 24)
  - Re: How to protect against cookie stealing? Ken Anderson (Jul 24)
- RE: How to protect against cookie stealing? Dawes, Rogan (ZA - Johannesburg) (Jul 27)
  - RE: How to protect against cookie stealing? .:[ Death Star]:. (Jul 27)
- RE: How to protect against cookie stealing? Dawes, Rogan (ZA - Johannesburg) (Jul 27)
- RE: How to protect against cookie stealing? Dawes, Rogan (ZA - Johannesburg) (Jul 28)
- RE: How to protect against cookie stealing? PortSwigger (Jul 29)
[ANNOUNCE] kses 0.2.0 Ulf Harnhammar (Jul 26)
Problems with most web app auth schemes Kevin Spett (Jul 26)
- Re: Problems with most web app auth schemes Erik Kangas, PhD (Jul 26)
- Re: Problems with most web app auth schemes Brant Langer Gurganus (Jul 27)
  - Re: Problems with most web app auth schemes Tim (Jul 27)
    - Re: Problems with most web app auth schemes George W. Capehart (Jul 27)
    - Re: Problems with most web app auth schemes Tim (Jul 27)
    - Re: Problems with most web app auth schemes George W. Capehart (Jul 28)
  - Re: Problems with most web app auth schemes Ingo Struck (Jul 27)
- Re: Problems with most web app auth schemes Ingo Struck (Jul 27)
- <Possible follow-ups>
- RE: Problems with most web app auth schemes Cowles, Robert D. (Jul 27)
  - Re: Problems with most web app auth schemes Ingo Struck (Jul 27)
- Re: Problems with most web app auth schemes webappsec (Jul 28)
- RE: Problems with most web app auth schemes Brass, Phil (ISS Atlanta) (Jul 29)
LDAP Injection White Paper SPI Labs (Jul 28)
Webscarab development continues Dawes, Rogan (ZA - Johannesburg) (Jul 29)
Re: Securityfocus article: Forensic Log Parsing with Microsoft's LogParser oded (Jul 29)
- Re: Securityfocus article: Forensic Log Parsing with Microsoft's LogParser M. Burnett (Jul 29)
HTML entity bignums Ulf Harnhammar (Jul 29)
- Re: HTML entity bignums Ingo Struck (Jul 29)
  - Global Web App Security Sity Pessoft (Jul 30)
- <Possible follow-ups>
- Re: HTML entity bignums Ulf Harnhammar (Jul 30)
  - Re: HTML entity bignums Ingo Struck (Jul 30)
- Re: HTML entity bignums Ulf Harnhammar (Jul 31)
Next WebGoat release Ty Bodell (Jul 29)
- Re: Next WebGoat release Jeff Williams @ Aspect (Jul 29)
  - Re: Next WebGoat release Mark Curphey (Jul 29)
- <Possible follow-ups>
- RE: Next WebGoat release Hearne, Chuck (Jul 29)
[ANNOUNCE] IISShield v1.0 rawdata (Jul 29)
[Advisory] IISShield V1.0.2 rawdata (Aug 01)
Browser refresh sends username/password after log out -- URGENT K Kohli (Aug 05)
- Re: Browser refresh sends username/password after log out -- URGENT Alex 'CAVE' Cernat (Aug 05)
- RE: Browser refresh sends username/password after log out -- URGENT Tiago Halm (Aug 05)
- Re: Browser refresh sends username/password after log out -- URGENT Imre Kertesz (Aug 05)
  - Re: Browser refresh sends username/password after log out -- URGENT Spicciati Jaime (Aug 05)
  - Re: Browser refresh sends username/password after log out -- URGENT Phillip Schroeder (Aug 05)
- <Possible follow-ups>
- Re: Browser refresh sends username/password after log out -- URGENT najeeb . hatami (Aug 05)
- RE: Browser refresh sends username/password after log out -- URGENT Ingo Struck (Aug 05)
  - RE: Browser refresh sends username/password after log out -- URGENT Krk (Aug 06)
    - Re: Browser refresh sends username/password after log out -- URGENT Ingo Struck (Aug 06)
    - RE: Browser refresh sends username/password after log out -- URGENT Tim Aranki (Aug 06)
    - Re: Browser refresh sends username/password after log out -- URGENT Chris Scott (Aug 06)
    - RE: Browser refresh sends username/password after log out -- URGENT roshen.chandran (Aug 07)
    - Re: Browser refresh sends username/password after log out -- URGENT Jim McGarvey (Aug 06)
- RE: Browser refresh sends username/password after log out -- URGENT Michael Silk (Aug 05)
Securig IIS Server NR (Aug 05)
- RE: Securig IIS Server dave kleiman (Aug 05)
- RE: Securig IIS Server Tiago Halm (Aug 06)
RE: Browser refresh sends username/password after log out -- URGE NT Dean Saxe (Aug 05)
- <Possible follow-ups>
- RE: Browser refresh sends username/password after log out -- URGE NT Andy Talbot (Aug 06)
IIS log Justin H Tran (Aug 05)
- Re: IIS log Alejandro Flores (Aug 05)
- Re: IIS log Randy (Aug 05)
- <Possible follow-ups>
- RE: IIS log Michael Howard (Aug 05)
  - RE: IIS log Richard M. Smith (Aug 05)
- Re: IIS log dotnetter (Aug 05)
- Re: IIS log jamesworld (Aug 05)
- RE: IIS log Nelson, Ernie (Aug 05)
[ Re: IIS log] Jean-Jacques Halans (Aug 05)
OWASP update and columnists wanted Mark Curphey (Aug 05)
Paros v3.0 for web application security assessment contact (Aug 06)
Custom session tokens and XSS PortSwigger (Aug 12)
- Re: Custom session tokens and XSS Marc Slemko (Aug 12)
- <Possible follow-ups>
- RE: Custom session tokens and XSS Dean Saxe (Aug 12)
- RE: Custom session tokens and XSS Rob Morhaime (Aug 12)
  - RE: Custom session tokens and XSS Stephen de Vries (Aug 13)
    - Re: Custom session tokens and XSS Thomas Chiverton (Aug 13)
    - Re: Custom session tokens and XSS Stephen de Vries (Aug 13)
    - Re: Custom session tokens and XSS Ingo Struck (Aug 13)
    - Re: Custom session tokens and XSS Stephen de Vries (Aug 13)
    - Re: Custom session tokens and XSS Cyrill Osterwalder (Aug 13)
    - Re: Custom session tokens and XSS PortSwigger (Aug 13)
    - Re: Custom session tokens and XSS Ingo Struck (Aug 14)
    - Re: Custom session tokens and XSS PortSwigger (Aug 14)
    - Re: Custom session tokens and XSS Ingo Struck (Aug 14)
    - Re: Custom session tokens and XSS Ian (Aug 14)
    - Switching off scripts Ingo Struck (Aug 14)
    - Re: Custom session tokens and XSS PortSwigger (Aug 14)
    - Re: Custom session tokens and XSS Stephen de Vries (Aug 14)
  - Re: Custom session tokens and XSS dafydd (Aug 13)
- Re: Re: Custom session tokens and XSS Mark Reardon (Aug 14)
  - Re: Custom session tokens and XSS Ingo Struck (Aug 14)
DB2 and Oracle with SQL injection fr0stman (Aug 13)
- Re: DB2 and Oracle with SQL injection Kevin Spett (Aug 13)
- <Possible follow-ups>
- RE: DB2 and Oracle with SQL injection Shao Jiangning-FGCP189 (Aug 13)
:o) hokkaido (Aug 22)
- Re: :o) Gavin Zuchlinski (Aug 22)
- <Possible follow-ups>
- RE:RE: :o) hokkaido (Aug 25)
  - Re: RE:RE: :o) Tim Greer (Aug 25)
  - Re: :o) Dwayne Ghant (Aug 25)
Advanced techniques with "exodus proxy" Ralph M. Los (Aug 23)
- <Possible follow-ups>
- RE: Advanced techniques with "exodus proxy" Dawes, Rogan (ZA - Johannesburg) (Aug 25)
PHP variable sanitization functions Gavin Zuchlinski (Aug 24)
- Re: PHP variable sanitization functions Liam Quinn (Aug 24)
  - Re: PHP variable sanitization functions Jamie Pratt (Aug 25)
  - Re: PHP variable sanitization functions Gavin Zuchlinski (Aug 25)
- <Possible follow-ups>
- Re: PHP variable sanitization functions Ulf Harnhammar (Aug 26)
  - Re: PHP variable sanitization functions Jan Pieter Kunst (Aug 26)
    - Re: PHP variable sanitization functions Cameron Green (Aug 26)
    - Re: PHP variable sanitization functions Jan Pieter Kunst (Aug 27)
    - Re: PHP variable sanitization functions Cameron Green (Aug 27)
    - Re: PHP variable sanitization functions Gavin Zuchlinski (Aug 28)
    - Re: PHP variable sanitization functions Jean-Jacques Halans (Aug 29)
    - Looking for coder.htm / ASCII encoder n30 (Aug 29)
    - Re: PHP variable sanitization functions Tim Tompkins (Aug 29)
- Re: PHP variable sanitization functions hokkaido (Aug 26)
- Re: PHP variable sanitization functions Slow2Show (Aug 26)
Clarlification on DB2 sql injection fr0stman (Aug 25)
answering my own question on DB2 sql injection fr0stman (Aug 25)
DB2 database mining with SQL injection fr0stman (Aug 25)
towards a taxonomy of Information Assurance (IA) Abe Usher (Aug 26)
- <Possible follow-ups>
- Re: towards a taxonomy of Information Assurance (IA) Mark Curphey (Aug 26)
Re: php sanitization functions hokkaido (Aug 26)
Using Binary Search with SQL Injection Sverre H. Huseby (Aug 26)
- <Possible follow-ups>
- Re: Using Binary Search with SQL Injection dave (Aug 28)
about data type checking at php sanitizer functions hokkaido (Aug 27)
Perl variable sanitization functions Gavin Zuchlinski (Aug 29)
- Re: Perl variable sanitization functions Tim Greer (Aug 29)
  - Re: Perl variable sanitization functions Tim Greer (Aug 29)
  - Re: Perl variable sanitization functions Nigel Stepp (Aug 29)
    - Re: Perl variable sanitization functions Tim Greer (Aug 29)
Fw: IIS log - GETs vs. POSTs Matt Fisher (Aug 30)
- Re: IIS log - GETs vs. POSTs Jeremy Poteet (Aug 30)
  - Re: IIS log - GETs vs. POSTs RSnake (Aug 30)
    - Re: IIS log - GETs vs. POSTs Lucas Holt (Aug 30)
    - Re: IIS log - GETs vs. POSTs RSnake (Aug 31)
- <Possible follow-ups>
- RE: IIS log - GETs vs. POSTs Calderon, Juan C (EM, DDEMESIS) (Sep 01)
  - RE: IIS log - GETs vs. POSTs RSnake (Sep 01)
    - RE: IIS log - GETs vs. POSTs Guille -bisho- (Sep 01)
    - RE: IIS log - GETs vs. POSTs RSnake (Sep 01)
- RE: IIS log - GETs vs. POSTs Brown, James F. (Sep 17)
Securityfocus Article: "Securing MySQL: step-by-step" bugtraq (Aug 31)
RE: Looking for coder.htm / ASCII encoder Dawes, Rogan (ZA - Johannesburg) (Sep 01)
- <Possible follow-ups>
- RE: Looking for coder.htm / ASCII encoder Noam Eppel (Sep 01)
  - Re: Looking for coder.htm / ASCII encoder Jason (Sep 01)
- RE: Looking for coder.htm / ASCII encoder Brewis, Mark (Sep 02)
  - Book on Java Security n30 (Sep 05)
    - Re: Book on Java Security Al Sutton (Sep 05)
    - Re: Book on Java Security Rory (Sep 05)
    - Re: Book on Java Security Gary Ellison (Sep 20)
Whitepaper - Blindfolded SQL Injection WebCohort Research (Sep 01)
- <Possible follow-ups>
- RE: Whitepaper - Blindfolded SQL Injection MARZIOU,GAEL (HP-France,ex1) (Sep 02)
Authentication/Access-control libraries n30 (Sep 02)
- Re: Authentication/Access-control libraries George Capehart (Sep 03)
- <Possible follow-ups>
- RE: Authentication/Access-control libraries Lapinski, Michael (Research) (Sep 02)
  - Re: Authentication/Access-control libraries jdk (Sep 02)
- Re: Authentication/Access-control libraries cunningham . simon (Sep 03)
  - RE: Authentication/Access-control libraries TUER, DON (Sep 03)
- RE: Authentication/Access-control libraries Sasha Romanosky (Sep 25)
Flash sites John Madden (Sep 03)
- Re: Flash sites Thomas Chiverton (Sep 04)
- Re: Flash sites RSnake (Sep 04)
- Re: Flash sites Max Moser (Sep 04)
  - Re: Flash sites RSnake (Sep 04)
- Re: Flash sites Jean-Jacques Halans (Sep 04)
- Re: Flash sites Jeremiah Grossman (Sep 04)
  - Re: Flash sites ADex (Sep 06)
- <Possible follow-ups>
- RE: Flash sites Nick Duda (Sep 03)
  - RE: Flash sites Mathew C. Beckman (Sep 04)
- RE: Flash sites Piet Carpentier (Sep 04)
- Re:Flash sites leorl (Sep 04)
- FW: Flash sites GRIFFITHS ian (Sep 05)
IE feature to prevent Cross Site Scripting not working? Oh Yong Lee (Sep 04)
OWASP Survey 2003 Mark Curphey (Sep 04)
WebDav Questions webappsecquestions (Sep 07)
Blind SQL Injection white paper from SPILabs of Spidynamics, Inc SPI Labs (Sep 08)
Approach for testing sites that use RDS Daniel (Sep 08)
- <Possible follow-ups>
- RE: Approach for testing sites that use RDS Dawes, Rogan (ZA - Johannesburg) (Sep 08)
RE: Book on Java Security Harbar, Spencer (Sep 08)
CSS before redirect Stephen de Vries (Sep 08)
- Re: CSS before redirect Jeremiah Grossman (Sep 08)
  - Re: CSS before redirect Marc Slemko (Sep 08)
- RE: CSS before redirect Thomas Schreiber (Sep 09)
PHP/Perl variable sanitization Gavin Zuchlinski (Sep 08)
ISS6 - ASP.NET webappsec (Sep 09)
- Re: ISS6 - ASP.NET H D Moore (Sep 09)
- RE: ISS6 - ASP.NET TUER, DON (Sep 09)
- <Possible follow-ups>
- RE: ISS6 - ASP.NET Jackson, Chris (Sep 09)
  - Re: ISS6 - ASP.NET Ernie Nelson (Sep 09)
- RE: ISS6 - ASP.NET webappsec (Sep 09)
SQL injection and PHP/MYSQL Robert Buljevic (Sep 09)
- Re: SQL injection and PHP/MYSQL Sverre H. Huseby (Sep 09)
- Re: SQL injection and PHP/MYSQL Bill Pennington (Sep 09)
- Re: SQL injection and PHP/MYSQL Denis Arh (Sep 09)
- Re: SQL injection and PHP/MYSQL shimi (Sep 09)
  - Re: SQL injection and PHP/MYSQL Brad Fults (Sep 10)
    - Re: SQL injection and PHP/MYSQL Jan Pieter Kunst (Sep 10)
    - Re: SQL injection and PHP/MYSQL Sverre H. Huseby (Sep 10)
- <Possible follow-ups>
- RE: SQL injection and PHP/MYSQL Keifer, Trey (Sep 09)
New OWASP Columns Mark Curphey (Sep 11)
Dictionary and brute forcing web authentication? Mark G. Spencer (Sep 12)
- <Possible follow-ups>
- Re: Dictionary and brute forcing web authentication? DownBload (Sep 13)
- Re: Dictionary and brute forcing web authentication? Chris Varenhorst (Sep 14)
  - Re: Dictionary and brute forcing web authentication? RSnake (Sep 15)
- RE: Dictionary and brute forcing web authentication? Calderon, Juan C (EM, DDEMESIS) (Sep 15)
  - Re: Dictionary and brute forcing web authentication? Martin Eiszner (Sep 15)
  - RE: Dictionary and brute forcing web authentication? Sarbjit Singh Gill (Sep 15)
- Re: Dictionary and brute forcing web authentication? Sasa Jusic (Sep 15)
- RE: Dictionary and brute forcing web authentication? Calderon, Juan C (EM, DDEMESIS) (Sep 15)
- RE: Dictionary and brute forcing web authentication? latte (Sep 15)
- RE: Dictionary and brute forcing web authentication? Calderon, Juan C (EM, DDEMESIS) (Sep 22)
Paros v3.0.1 for web application security assessment contact (Sep 15)
- RE: Paros v3.0.1 for web application security assessment Sakaba (Sep 15)
  - website and privacy n30 (Sep 16)
    - Re: website and privacy Tim Greer (Sep 16)
- <Possible follow-ups>
- RE: Paros v3.0.1 for web application security assessment Dawes, Rogan (ZA - Johannesburg) (Sep 16)
Cache-Control Pessoft (Sep 15)
- Re: Cache-Control Sverre H. Huseby (Sep 15)
- <Possible follow-ups>
- RE: Cache-Control Thor Larholm (Sep 15)
Looking for a POST statement Sniffer Andy Talbot (Sep 15)
- Re: Looking for a POST statement Sniffer Ivan Ristic (Sep 15)
- Re: Looking for a POST statement Sniffer Jon Hart (Sep 15)
- <Possible follow-ups>
- RE: Looking for a POST statement Sniffer Tom Arseneault (Sep 15)
- RE: Looking for a POST statement Sniffer Dawes, Rogan (ZA - Johannesburg) (Sep 16)
HTTP CONNECT and WebDav Authentication webappsecquestions (Sep 15)
- RE: HTTP CONNECT and WebDav Authentication Kevin Spett (Sep 16)
PHP for preventing SQL injections? Lefevre, Steven (Sep 16)
- Re: PHP for preventing SQL injections? Security OnLine.tk (Sep 16)
  - Re: PHP for preventing SQL injections? wilfrid (Sep 17)
    - Re: PHP for preventing SQL injections? cipherz (Sep 17)
    - Re: PHP for preventing SQL injections? Harry M (Sep 18)
- Re: PHP for preventing SQL injections? weigelt (Sep 16)
- Re: PHP for preventing SQL injections? David Bernick (Sep 18)
- <Possible follow-ups>
- RE: PHP for preventing SQL injections? latte (Sep 16)
  - Re: PHP for preventing SQL injections? Alex Lambert (Sep 16)
    - RE: PHP for preventing SQL injections? Lefevre, Steven (Sep 17)
    - Re: PHP for preventing SQL injections? Sverre H. Huseby (Sep 18)
- RE: PHP for preventing SQL injections? latte (Sep 16)
  - Re: PHP for preventing SQL injections? Gavin Zuchlinski (Sep 17)
websites and privacy Hephaestus (Sep 16)
- Re: websites and privacy Tim Greer (Sep 16)
PHP for preventing SQL injections? Ulf Harnhammar (Sep 17)
- <Possible follow-ups>
- Re: PHP for preventing SQL injections? b0iler _ (Sep 21)
- Re: PHP for preventing SQL injections? Ulf Harnhammar (Sep 22)
  - Re: PHP for preventing SQL injections? Sverre H. Huseby (Sep 22)
    - Re: PHP for preventing SQL injections? David Cameron (Sep 23)
- Re: PHP for preventing SQL injections? Ulf Harnhammar (Sep 23)
  - Re: PHP for preventing SQL injections? Sverre H. Huseby (Sep 23)
JSP security abhishek.kumar (Sep 18)
Administrivia Mark Curphey (Sep 20)
IIS 5.0 Session Hijacking Question Robin Fordham (Sep 23)
- <Possible follow-ups>
- RE: IIS 5.0 Session Hijacking Question Jones, Chris (Sep 23)
- RE: IIS 5.0 Session Hijacking Question lj-news (Sep 25)
Open Source Certificate authority Jared Ingersoll (Sep 23)
- Re: Open Source Certificate authority Don Fike (Sep 23)
- Re: Open Source Certificate authority Keith W. McCammon (Sep 23)
- <Possible follow-ups>
- RE: Open Source Certificate authority Tenorio, Leandro (Sep 23)
- RE: Open Source Certificate authority Jared Ingersoll (Sep 23)
  - Re: Open Source Certificate authority Alex Russell (Sep 23)
    - Re: Open Source Certificate authority George W. Capehart (Sep 24)
  - Re: Open Source Certificate authority Chackan Lai (Sep 23)
  - Re: Open Source Certificate authority Keith W. McCammon (Sep 24)
  - RE: Open Source Certificate authority Dave Ockwell-Jenner (Sep 24)
  - Re: Open Source Certificate authority Dorian Moore (Sep 24)
  - RE: Open Source Certificate authority TUER, DON (Sep 24)
- RE: Open Source Certificate authority Lapinski, Michael (Research) (Sep 23)
- RE: Open Source Certificate authority Tenorio, Leandro (Sep 23)
- RE: Open Source Certificate authority Chip Kelly (Sep 24)
- RE: Open Source Certificate authority Lapinski, Michael (Research) (Sep 24)
- RE: Open Source Certificate authority Jared Ingersoll (Sep 24)
- RE: Open Source Certificate authority Law, Gary, (FNB) (Sep 24)
- RE: Open Source Certificate authority Jared Ingersoll (Sep 24)
  - Re: Open Source Certificate authority George W. Capehart (Sep 24)
OWASP Positive Change Noam Eppel (Sep 23)
Question on input validation Noah Gray (Sep 24)
- <Possible follow-ups>
- RE: Question on input validation Scovetta, Michael V (Sep 24)
  - Re: Question on input validation Alex Russell (Sep 24)
Black Hat Windows Call for Papers Jeff Moss (Sep 24)
Guardian () JUMPERZ NET released Kanatoko (Sep 25)
OWASP Columns Mark Curphey (Sep 25)
IP Address Question Robin Fordham (Sep 25)
- Re: IP Address Question David Wall @ Yozons (Sep 25)
- Re: IP Address Question George Johnson (Sep 25)
- <Possible follow-ups>
- RE: IP Address Question lj-news (Sep 25)
- RE: IP Address Question Perry, Blane (Sep 25)
Paros 3.0 requirements Jeff Sani (Sep 25)
- Re: Paros 3.0 requirements Breno Jacinto (Sep 26)
IP Address Question - Dead Thread by Midnight Mark Curphey (Sep 25)

Previous period