bugtraq - Re: Regular Expression Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200909281319.n8SDJ6Us011545@www3.securityfocus.com>
Date: Mon, 28 Sep 2009 07:19:06 -0600
From: hackerwebzine@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: Regular Expression Denial of Service

Alex, it isn't a new technique in web-application security. If you queried Google, or did some research on recent (2007) Blackhat talks, you'll probably noticed that this is very well known and understood technique. Even Charles Miller talked about it (on the OSX Safari exploits). So the claim that security researchers are not aware of it, it somewhat misleading. I personally (and many others too) used the same techniques, albeit slightly different for over 8 years when auditing applications. Since you seem to propose a serious "new" research area, i expect you to research it's history first before claiming "new" research, at least I would appreciate it.