July 2007
Chris Shiflett: CSRF Redirector
It's a simple tool that makes it easy to test CSRF using POST, hopefully demonstrating how prevalent CSRF vulnerabilities are as well as reducing the misconception that forging a POST request is complicated.
XSS post forwarder
by 1 other (via)This page is meant to enable people to easily showcase XSS flaws that use POST instead of GET. By linking to this page and providing GETed variables this page will build a form as specified which lets you show users the XSS flaw.
0x000000 ◊ The Hacker Webzine
I've talked about CSRF before, but this time I wanted to show some of the underlying basics of it and explain why it isn't a new trick or something special. It is part of browsers and the way HTTP works, also to remove any argument that POST should be safer then GET. I know this is Internet basics, it still can be refreshing to read it over from time to time.
June 2007
XSS (Cross Site Scripting) Cheat Sheet
by 17 others (via)This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion.
HTML Purifier - Filter your HTML the standards-compliant way!
by 18 othersHTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.
August 2006
Thinking Stone / ModSecurity - ModSecurity Console
(via)ModSecurity Console is a network-based console designed to collect logs and alerts from remote ModSecurity sensors in real-time, providing security analysts with the support they need to keep their web systems secure.
1
(6 marks)
