bugtraq - countermeasure against attacks through HTML shared files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <W337691240137311226034071@webmail20>
Date: Fri, 07 Nov 2008 05:01:11 +0000
From: fcorella@...cor.com
To: websecurity@...appsec.org, bugtraq@...urityfocus.com
Subject: countermeasure against attacks through HTML shared files

Hello,

I wanted to announce a Pomcor white paper that
looks at attacks through HTML shared files in Web
applications and proposes a countermeasure.  These
are essentially XSS attacks, but the usual
defenses against XSS are typically not available,
because shared files cannot be sanitized.

The paper is available at:

http://www.pomcor.com/whitepapers/file_sharing_security.pdf

I have not been able to find much prior work.
What I've found is discussed in Section 2 of the
paper.  If I've missed something, please let me
know.

Thanks,

Francisco Corella