Web Application Security

A few people asked for slides and links from the security talk from The Ajax Experience last week:

| View | Upload your own

General Links:

• OWASP: Open Web App Security Project
• Security Resources from the OpenAjax Alliance Wiki
• Mozilla on Same-Origin Policy

XSS:

• Introductions from: Wikipedia and Apache
• Cheat Sheet: Long list of XSS vectors from RSnake
• Explanation of DOM Based XSS
• Explanation of Samy is my Hero worm
• Fairly old FAQ at CGI Security
• List of XSS holes in popular web applications

CSRF:

• Introduction from: Wikipedia and here
• Article by Chris Shiflett and CSRF Redirector test tool
• CSRF FAQ at CGI Security
• Array constructor overriding
• A solution: SameRefererOnly
• Protecting a JSON or JavaScript Service

Blogs:

• Jeremiah Grossman
• Chris Shiflett
• RSnake
• GNUCITIZEN
• Google Online Security
• 0x000000
• Darknet