The changes are temporary on the individual user’s browser. However, the changes will allow that user to interact with your backend however they choose to do so. This is one way in which sites are attacked. The standard rule is to never trust input coming from the user / browser. Do not trust the value … Read more
I have problem in IE9 with securiry certificate. Then I go to specific address I got How can I avoid appearence of this window? I try enter on Continue to this website (not recommended). – cectificate error – View Certificates. I see that This certificate is OK. in certificate Status on certification Path tab. But … Read more
the simple way I believe is to import it then export it, using the certificate manager in Windows Management Console.
No, as it is interpreted on the server-side and the results are sent to the user. If you want to view the source code of a site you control in-browser, consider the FirePHP extension for Firebug, or just access your site files with your preferred method.
When Firefox web browser checks a security certificate, it also checks with the issuing authority if the certificate is valid. It appears that, near a certificate’s expiration date, the issuing authority may release a new certificate. The two certificates have conflicting expiration dates. For reasons unknown, this caused Firefox to report a sec_error_revoked_certificate error and … Read more
It drops the students table. The original code in the school’s program probably looks something like This is the naive way to add text input into a query, and is very bad, as you will see. After the values from the first name, middle name textbox FNMName.Text (which is Robert’); DROP TABLE STUDENTS; –) and the last name textbox LName.Text (let’s … Read more
This is specific for each site. So if you type that once, you will only get through that site and all other sites will need a similar type-through. It is also remembered for that site and you have to click on the padlock to reset it (so you can type it again): Needless to say … Read more
I assume that those crawlers are looking for auth_user_file.txt because its name is probably given in some tutorial for Apache’s mod_authn_file module; when an admin makes the mistake of putting the file in the webserver’s DOCROOT, then it is free for downloading by anyone who asks. Once an attacker downloads the file, they can brute-force the password hashes, and gain … Read more
Tom Scott explains this in his YouTube video: http://a/%%30%30 is decoded as http://a/%00 because %30 is 0 http://a/%00 is then further decoded by another piece of code as http://a/<NULL> because %00 is the NULL character The bug was originally demonstrated by Andris Atteka who simply added a null character to the string.
What is the simplest way of doing two way encryption in common PHP installs? I need to be able to encrypt data with a string key, and use the same key to decrypt on the other end. The security isn’t as big of a concern as the portability of the code, so I’d like to … Read more