Websec Cybersecurity Blog
Expert insights, trends, research findings, and best practices from our security team to help you strengthen your organization's security posture.
Three Non Web-based XSS Injections
In this post guest blogger Alejandro Hernandez (nitr0us) writes about some interesting and fun XSS vectors which are not commonly seen.
Cookie Stealing By Router Pharming (2Wire)
A multi-stage exploit that chains cross-site scripting, an information-disclosure magic URL, and a default-WEP password reset on 2Wire routers to poison DNS and harvest cookies from nearly any domain the victim visits.
Attacking Linksys WRT160N router using the "URL Obfuscation in Frames" bug
A walkthrough of combining a URL obfuscation bug in iframes with an older XSS in the Linksys WRT160N to silently enable remote administration, demonstrating a realistic drive-by attack against SOHO routers that still ship with default credentials.