Comments on: Author of the XSS Book http://www.gnucitizen.org/blog/author-of-the-xss-book/ Information Security Think Tank Fri, 29 Aug 2008 18:13:42 +0000 http://wordpress.org/?v=2.6.1 By: GNUCITIZEN » TinyURL FS among Other Things http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-15056 GNUCITIZEN » TinyURL FS among Other Things Fri, 20 Apr 2007 12:59:53 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-15056 [...] So yes, there is a lot going on and I think that soon Web application security industry will outgrow its original purpose. Today you need to look at Web application security globally. I will show you why. Meanwhile, the XSS Book, I discussed here, will be out very soon. I may bring several copies and give them away to those who correctly answer a few simple questions. [...] [...] So yes, there is a lot going on and I think that soon Web application security industry will outgrow its original purpose. Today you need to look at Web application security globally. I will show you why. Meanwhile, the XSS Book, I discussed here, will be out very soon. I may bring several copies and give them away to those who correctly answer a few simple questions. [...]

]]> By: GNUCITIZEN » Big Fish http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-12500 GNUCITIZEN » Big Fish Tue, 03 Apr 2007 13:01:19 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-12500 [...] We are nearly finished with the long awaited XSS book and I am really happy with the way it builds up. Everyone who is interesting in learning about the so called WEB2.0 hacking that raises the concerns of the masses today should definitely get a copy of the book. [...] [...] We are nearly finished with the long awaited XSS book and I am really happy with the way it builds up. Everyone who is interesting in learning about the so called WEB2.0 hacking that raises the concerns of the masses today should definitely get a copy of the book. [...]

]]> By: GNUCITIZEN » PDF and History Hacks http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-5642 GNUCITIZEN » PDF and History Hacks Thu, 01 Mar 2007 14:48:52 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-5642 [...] It is time to shed some light on what kind of stuff are developing at the moment. In the past couple of days I’ve been working heavily on the XSS book which is coming out very soon. I’ve been also involved with several projects which were released in the GNUCITIZEN Projects area. [...] [...] It is time to shed some light on what kind of stuff are developing at the moment. In the past couple of days I’ve been working heavily on the XSS book which is coming out very soon. I’ve been also involved with several projects which were released in the GNUCITIZEN Projects area. [...]

]]> By: pdp http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-5022 pdp Thu, 22 Feb 2007 07:26:51 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-5022 <blockquote>And about holes. I am talking about XSS vulnerabilities at your site - in WordPress (particularly).</blockquote> Really? Wow, I will be interested to see that, not that I am surprised. <blockquote>Not UXSS, but you can fix it also (and you better do).</blockquote> Show me a fix and I will show you how you can still abuse this hole. I've played with all kinds of server side fixes for this vulnerabilities and all of them can be circumvented. So, the solution is easy, update your plugin. It is client-side issue, not server-side.

And about holes. I am talking about XSS vulnerabilities at your site - in WordPress (particularly).

Really? Wow, I will be interested to see that, not that I am surprised.

Not UXSS, but you can fix it also (and you better do).

Show me a fix and I will show you how you can still abuse this hole. I’ve played with all kinds of server side fixes for this vulnerabilities and all of them can be circumvented. So, the solution is easy, update your plugin. It is client-side issue, not server-side.

]]> By: MustLive http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-5006 MustLive Thu, 22 Feb 2007 00:32:54 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-5006 Pdp, I am waiting until Amazon will update book's front cover and author's bio (because it will be interesting to read your bio). You can announce at your site about this event (when the book will be out). And about holes. I am talking about XSS vulnerabilities at your site - in WordPress (particularly). Not UXSS, but you can fix it also (and you better do). So wait for my detailed letter with information about XSS vulnerabilities at your site. Pdp, I am waiting until Amazon will update book’s front cover and author’s bio (because it will be interesting to read your bio).

You can announce at your site about this event (when the book will be out).

And about holes. I am talking about XSS vulnerabilities at your site - in WordPress (particularly). Not UXSS, but you can fix it also (and you better do).

So wait for my detailed letter with information about XSS vulnerabilities at your site.

]]> By: DeadOnArrival http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-4828 DeadOnArrival Tue, 20 Feb 2007 07:16:20 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-4828 Please continue to write this blog. Looking forward to your book. Please continue to write this blog. Looking forward to your book.

]]> By: pdp http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-4726 pdp Mon, 19 Feb 2007 14:22:36 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-4726 Thanks man, <blockquote>You need to contact Amazon :-), and tell them to put Petko Petkov to the list of the authors, because there is no your name in the list. And it is not good. Amazon need to add Pdp to the list! Every author need a portion of attention.</blockquote> Thanks for the advise. The reason I am not there is because I was invited to join the team at much later stage. The front cover and the author bio will change as soon as we get the book on Amazon. <blockquote>You also need to attend to security of your own site. As I planning to tell you for a long time already, there are many XSS holes at your site! So wait for my detailed letter.</blockquote> It could be the PDF thing which I already know about or it could be something on Wordpress that I don't know about. There is one thing that can be used for XSS, Backframe's inline profiles, however you get warned that a profile is about to be loaded, so it is not a big deal. If it is the PDF issue, I don't care that much. Yes, someone can get exploited on GNUCITIZEN, but that is not beneficial to anyone. If it is Wordpress, then I don't know. I would write my own blog software if I had the time. Thanks man,

You need to contact Amazon :-), and tell them to put Petko Petkov to the list of the authors, because there is no your name in the list. And it is not good. Amazon need to add Pdp to the list! Every author need a portion of attention.

Thanks for the advise. The reason I am not there is because I was invited to join the team at much later stage. The front cover and the author bio will change as soon as we get the book on Amazon.

You also need to attend to security of your own site. As I planning to tell you for a long time already, there are many XSS holes at your site! So wait for my detailed letter.

It could be the PDF thing which I already know about or it could be something on Wordpress that I don’t know about. There is one thing that can be used for XSS, Backframe’s inline profiles, however you get warned that a profile is about to be loaded, so it is not a big deal. If it is the PDF issue, I don’t care that much. Yes, someone can get exploited on GNUCITIZEN, but that is not beneficial to anyone. If it is Wordpress, then I don’t know. I would write my own blog software
if I had the time.

]]> By: MustLive http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-4646 MustLive Sun, 18 Feb 2007 23:06:28 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-4646 Petko! It is good that such professional web security guys will write such interesting security book (about XSS). I wish good luck to you, and RSnake and all authors' team and to your new book! And I am glad that you will be the 5th author with Jeremiah, RSnake and other guys. I feel that it will be 5th author and here it is. It is good to see you with these famous security experts in team. You need to contact Amazon :-), and tell them to put Petko Petkov to the list of the authors, because there is no your name in the list. And it is not good. Amazon need to add Pdp to the list! Every author need a portion of attention. Don't forget to write about all of types of XSS in the book. Write a chapter about UXSS and a chapter about XSS on SEO (black seo) ;-). And about many other interesting things. P.S. You also need to attend to security of your own site. As I planning to tell you for a long time already, there are many XSS holes at your site! So wait for my detailed letter. Petko!

It is good that such professional web security guys will write such interesting security book (about XSS). I wish good luck to you, and RSnake and all authors’ team and to your new book!

And I am glad that you will be the 5th author with Jeremiah, RSnake and other guys. I feel that it will be 5th author and here it is. It is good to
see you with these famous security experts in team.

You need to contact Amazon :-), and tell them to put Petko Petkov to the list of the authors, because there is no your name in the list. And it is not good. Amazon need to add Pdp to the list! Every author need a portion of attention.

Don’t forget to write about all of types of XSS in the book. Write a chapter about UXSS and a chapter about XSS on SEO (black seo) ;-). And about many other interesting things.

P.S.

You also need to attend to security of your own site. As I planning to tell you for a long time already, there are many XSS holes at your site! So wait for my detailed letter.

]]> By: GNUCITIZEN » Vista Speech Recognition http://www.gnucitizen.org/blog/author-of-the-xss-book/#comment-4509 GNUCITIZEN » Vista Speech Recognition Sat, 17 Feb 2007 22:31:56 +0000 http://www.gnucitizen.org/blog/author-of-the-xss-book#comment-4509 [...] Since I am busy with completing chapters from the XSS book as I discussed in the previous post, here is a video that is a must see. Before playing the video, please read the rest of this post. [...] [...] Since I am busy with completing chapters from the XSS book as I discussed in the previous post, here is a video that is a must see. Before playing the video, please read the rest of this post. [...]

]]>