Websec Cybersecurity Blog
Expert insights, trends, research findings, and best practices from our security team to help you strengthen your organization's security posture.
Articles
Attacking Linksys WRT160N router using the "URL Obfuscation in Frames" bug
A walkthrough of combining a URL obfuscation bug in iframes with an older XSS in the Linksys WRT160N to silently enable remote administration, demonstrating a realistic drive-by attack against SOHO routers that still ship with default credentials.
Do not trust your browser's status bar
Many people rely on the status bar for checking the destination of links, but it has been proven before that it is easy to falsify.
egrepping mod_security logs
A handy set of egrep one-liners for pulling the most useful information out of mod_security logs, including top user agents, HTTP status codes, referrers, and the scripts most frequently targeted by attackers.