CySCA 2014: four web challenges from an Australian student CTF
Four 2014 CySCA web challenges, covering trust-the-client access control, markdown XSS, CSRF-protected SQL injection, and hash length extension.
Read moreArchive: 2014
Notes first published in 2014.
A history of PaX: the hardening project that predicted modern exploit mitigations
A retrospective on PaX, the long-running Linux hardening patch whose early-2000s ideas anticipated ASLR, NX and other mainstream mitigations.
Read moreAutomatically finding XSS inside Flash files
A dynamic testing approach that loads Flash files in a scriptable headless browser and watches for JavaScript execution to flag XSS.
Read moreWhat a QQ group data lookup tool reveals about aggregation risk
An old lookup tool for QQ group membership data illustrates how aggregating many small public details can create a privacy exposure no single data point suggests on its own.
Read more