Welcome to MSDN Blogs Sign in | Join | Help

Browse by Tags

All Tags » Computer Securi... » Web Application Security   (RSS)
Thursday, July 03, 2008 11:55 PM

IE8 XSS Filter design philosophy in-depth

It's great to see some positive reaction to the potential of our XSS Filter. Now we just need to deliver! In this blog post I’ll try to shed some light on our design philosophy. To understand how we have arrived at our current filtering approach, it is
Posted by dross | 1 Comments
Wednesday, July 02, 2008 9:29 AM

IE8 goes on the offensive against XSS!

IE has announced the new XSS Filter feature which will debut in IE8 Beta 2! Stay tuned to my blog in the coming weeks for more details on how the filter works, its history, its limitations, and some lessons learned during the development process.
Posted by dross | 1 Comments
Monday, March 10, 2008 1:06 PM

XSS-Focused Attack Surface Reduction

All web browsers expose what have been referred to as XSS “attack vectors” – various techniques that XSS attacks can leverage to achieve script execution. The best and most well regarded list of these behaviors is RSnake’s XSS Cheat Sheet . The existence
Posted by dross | 3 Comments
Wednesday, September 12, 2007 10:34 AM

MashupOS

The standard IFRAME-based isolation technique for web apps is starting to show its age. We need something better! Microsoft Research has posted a new paper scheduled to appear at SOSP '07 : Protection and Communication Abstractions for Web Browsers in
Posted by dross | 0 Comments
Friday, August 03, 2007 11:17 AM

Pinning / Rebinding / Quick-Swap DNS Links

A group at Stanford has been researching these issues and recently published Protecting Browsers from DNS Rebinding Attacks . Also, Dan Kaminski has published his slides from Blackhat 2007, Black Ops 2007: Design Reviewing The Web .
Posted by dross | 0 Comments
Monday, July 09, 2007 3:15 PM

Notes on DNS Pinning

Christian Matthies has an excellent writeup on DNS Pinning (with diagrams!) If you're tuned into web app security you've probably noticed a lot of discussion around Anti DNS Pinning a.k.a. DNS Rebinding a.k.a. Quick-Swap DNS lately. You're likely to see
Posted by dross | 1 Comments
 
Page view tracker