Home » Tags

XSSAudit

🔥 Featured Posts

How to Block ECH and Mitigate DoH in Enterprise Networks

How to Block ECH and Mitigate DoH in Enterprise Networks

A hands-on guide using dnsmasq to filter SVCB and HTTPS records for disabling ECH and enforcing central DNS policies. Notes that DoH requires separate network-layer policies.

Review of Citrix Security Policy Effectiveness

Review of Citrix Security Policy Effectiveness

Citrix administrators apply security policies to each user’s VDI (Virtual Desktop Infrastructure) through Citrix Group Policy. However, certain structural vulnerabilities in Citrix CSE (Citrix Service Engine) and the Citrix VDI Agent allow for potential bypassing of these security policies.

Security threats and mitigation strategies for java reflection

Security threats and mitigation strategies for java reflection

The **Java Reflection API** is a powerful tool that allows dynamic manipulation of classes, methods, and interfaces at runtime. However, due to its flexibility, it introduces significant security risks, as attackers can exploit it to gain unauthorized access to systems. In this article, we will explore the security threats posed by Java Reflection and outline strategies to mitigate these risks.

About the XSSAudit

Why Was the XSSAudit Feature Removed in Chrome? The Google Security Team proposed to the Chrome development team to remove the XSSAudit feature. Although the only rationale provided was that the feature could be bypassed (as argued in a paper by evn@google.com), it initially seemed unlikely that removal would proceed. However, it was ultimately decided that the feature would be completely eliminated in Chrome. The main point of the paper is that bypass methods using targets within new JavaScript frameworks are difficult to defend against. Therefore, it proposes a shift from the existing mitigation approach (the xssaudit filter) to an isolation/prevention method, namely Content Security Policy (CSP). ...

August 8, 2019 · 2 min · 336 words