This week thousands of system administrators who make use of Goolge products will open their inbox to see an email from Google explaining that their Web Optimizer product contains an XSS flaw that allows hackers to inject scripts into their Google Optimized web pages.
Acunetix WVS v7 build 20101206 automatically checks for DOM XSS
The new build of Acunetix Web Vulnerability scanner Version 7 checks for DOM based XSS vulnerabilities. Unlike the traditional cross-site scripting vulnerability, document object model based cross-site scripting (DOM XSS) vulnerability is a type of vulnerability which affects the script code in the client’s browser. …
Statistics from a phisher’s list
Yesterday night I was following some security related forums and some person posted a phishing kit for a popular bank from Romania. A phishing kit is a collection of scripts to help a script kiddie launch a phishing exploit and steal data such as credit…
Acunetix WVS Version 7 build 20101123 released
An updated build of Acunetix WVS Version 7 was released. Improvement: More updates to the Client Script Analyser (CSA) engine for better Web 2.0 support Bug Fixes: Fix: Added port in host header for https in manual browsing Fixed: Crawler not serving pages to Client…
HTTP Post Denial Of Service: more dangerous than initially thought
Wong Onn Chee and Tom Brennan from OWASP recently published a paper* presenting a new denial of service attack against web servers. What’s special about this denial of service attack is that it’s very hard to fix because it relies on a generic problem in…
Notable changes in PCI DSS 2.0 affecting Web application security
“Clarification, additional guidance, and evolving requirements” – welcome to the new PCI standards! Hot off the press are the new PCI DSS and PA-DSS requirements which take effect January 1, 2011. So, if you work in or around Web application security, it’ll behoove you to…
Acunetix WVS Version 7 build 20101115 released
An updated build of Acunetix WVS Version 7 was released. It includes a new feature, and improved support for JQuery and Web 2.0 web applications. New Features: Ability to stop individual running security scripts during a scan Major Improvements: CSA engine now supports a wider…
Application Security; Don’t get caught off guard with dangerous assumptions
Don’t get caught off guard. We hear that statement all the time with regards to information security. Sadly, as many businesses have experienced, such talk is cheap. Obviously no one wants their Web site to get hacked. Okay, maybe a few admins or developers who…
Holidays Brings out the Bad Guys
As you might expect, there is a projected large increase in criminal activities forecasted for this year. Driving malware and trojan infections via YOUR website is now becoming more of a standard operating procedure than ever. As reported in ThreatPosts more recent listing: ‘Spammers Gearing…