Show HN: Security Training for Developers • Hacker News Board

Re: Show HN: Security Training for Developers

#31

Post by TACIXAT » Thu, Mar 10, 2016, 1:56 PM UTC

johnsonjo wrote: post #20

TACIXAT wrote: post #18

Security is hard. XSS lol. http://i.imgur.com/3QJfsu7.png

Even though you did manage to get that far. It doesn't seem that you can actually make it persist or anything like that on his site so it is probably about as useful of an XSS as typing directly into the console on your browser.

Yea, I wouldn't have posted it here if it was more severe. Just some fun script injection.

Re: Show HN: Security Training for Developers

#32

Post by mason55 » Thu, Mar 10, 2016, 1:57 PM UTC

johnsonjo wrote: post #20

TACIXAT wrote: post #18

Security is hard. XSS lol. http://i.imgur.com/3QJfsu7.png

Even though you did manage to get that far. It doesn't seem that you can actually make it persist or anything like that on his site so it is probably about as useful of an XSS as typing directly into the console on your browser.

Reflected XSS is still a big security problem.

http://www.acunetix.com/blog/articles/non-persistent-xss/

Re: Show HN: Security Training for Developers

#33

Post by TACIXAT » Thu, Mar 10, 2016, 2:01 PM UTC

malcolmhere wrote: post #19

TACIXAT wrote: post #18

Security is hard. XSS lol. http://i.imgur.com/3QJfsu7.png

Oh wow. Would love to know you did that. :-o

Just put a script in the username field, sorry if that wasn't clear.

    alert(0)

All the live updating that module does, I figured there might be some code injection.

Re: Show HN: Security Training for Developers

#34

Post by malcolmhere » Thu, Mar 10, 2016, 4:23 PM UTC

dagrz wrote: post #24

I feel like Secure Code Warrior has solved this problem much better with gamification. https://www.securecodewarrior.com/

Interesting site, never seen that before. It's kind of hard to get a feel for what the product does, though, without any screenshots.

Re: Show HN: Security Training for Developers

#35

Post by malcolmhere » Thu, Mar 10, 2016, 4:26 PM UTC

michaelmior wrote: post #23

> Imagine if a user has their email account hacked - the first thing an attacker will do is try to compromise their other online accounts, and long-lived password reset links make this easy. I don't see how the length of time the reset link is valid really has any bearing here. I'm assuming the implication is that an attack could search for old password reset emails but if they have access to the email account, why n…

Well spotted - I kind of mangled that explanation. The risk being mitigated is if somebody gets a dump of your old emails. Short-lived reset tokens don't help if they have full access to you email account.

Re: Show HN: Security Training for Developers

#36

Post by reledi » Thu, Mar 10, 2016, 7:05 PM UTC

Regarding the customer references, I'm always highly suspicious of anonymous praise. Do you not have permission from the authors or companies to use their name?

Re: Show HN: Security Training for Developers

#37

Post by HoyaSaxa » Sun, Mar 13, 2016, 4:24 PM UTC

@malcolmhere keep up the great work. I have always found the current resources to be lacking especially in terms of implementation examples. One suggestion would be to remove the Chase logo in your SQL injection examples. It is just begging for a cease and desist letter.