Mindmap: Web2.0 hacking

The following mindmap represents almost everything that I have in mind when talking about Web2.0 hacking. It is a bit messy and quite unclear but it does the job. Most of the mindmap content is covered in my paper, titled “For my next trick… hacking Web2.0″, which is yet to be released. I am planning to discuss the topic on several conferences that will take place later this year, of course by constantly improving on the subject and the demonstrations that I have prepared.

I hope that my point of view… I mean the way I look into Web2.0 is a lot clearer since OWASP. This research is built upon my previous work so you might be familiar with some of the concepts. However, it is important to understand the application as well. The paper is designed to fill this gap.

Comments

Jesper responds:

Is it only me, or is this map not working in Firefox on XP? I’m trying to scroll around but the canvas is blank. Also there is no zoom buttons. IE7 works fine.

And which technology is that map made with, Java?

pdp responds:

Jesper, it works perfectly fine on FF. You should have JavaScript turned on.

Al responds:

How about posting an actual MM?

suleymanovic responds:

Hi,
Nice work indeed. Can we get the mm file?
Cheers.

pdp responds:

The mindmap was built with MindMeister. Unfortunately, I am not a premium user so I cannot export into MM. However, the map is on-line for everyone to see so it is not a big deal.

suleymanovic, thanks for the link.

Kender responds:

Funny that you’d use a XSS vulnerable site for that: http://www.mindmeister.com/map.....amp;zoom=1‘%3E%3C/script%3E%3Cscript%3Ealert(‘boo’)%3C!–

pdp responds:

Well, this is not my problem, is it? Moreover, 99% of the Web is vulnerable to XSS. This does not necessarily means that we should stop using it, right? :)

Kender responds:

True, just thought it ironic that you’d advise people to enable javascript for a site like that.
Although defacing someone’s mindmap is not all that exciting..

pdp responds:

uh?! try defacing the mindmap on this site :) I am very interested to see how this can be done. Certainly you are not going to affect the GC visitors. This is why I am saying that it is not really my problem.

Kender responds:

I agree. As long as you yourself do not visit any vulnerable sites or click untrusted links while logged in to mindmeister, your session data and therefore your mindmap should be perfectly safe.

pdp responds:

exactly, this is what I refer to as calculated risk. As you brought up the service is vulnerable to XSS, but this is the case with most Websites. So we are left with pretty much no option? Not really. We can continue using the service having in mind this issue.

The same applies when you walk on the streets. Yes, there is a chance to get killed but you’ve calculated the risk and assured that the chances are slim. This could be due to many things such as the fact that you are walking on the street during the day, for example.

tenest responds:

ditto what Jesper said: doesnt work for me with FF on XP (with javascript enabled or without). The link to the full size version does though.

pdp responds:

I have no idea… maybe your resolution is too small and due to the fact the map has a lot of whitespace, you cannot see the root tree. It works on WinXP2 with FF. I’ve just double checked it.

josh responds:

I get the white box, the zoom icons, the loading indicator, but nothing else.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6) Gecko/20061201 Firefox/2.0.0.6 (Ubuntu-feisty)

vic responds:

The reason the MM doesn’t show in FF is because you’ve stuck it in a frame whioh links to the original mindmeister MM. When I open the frame in a new tab/window I get a message from mindmeister saying “The owner of the map has to be premium member to include this map on a web page.”.

Mindmeister allows export to other formats (including GIF) IIRC.

ilmi responds:

good ide….

chris responds:

the MM does not work on XP with IE6

GNUCITIZEN

Navigation

Mindmap: Web2.0 hacking

Comments

Respond

The Others

External Projects

Recent Posts

Random Posts

From The Cutting-edge Network