Egor Homakov

This blog is closed, new posts will be published at  http://sakurity.com/blog Thanks for being with me here for so many years :)

I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...

Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...

When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...

TL;DR I use a race condition to upload two avatars at the same time to exploit another Paperclip bug and get remote code execution on Apach...

I bet, you know what Clickjacking  (CJ) is. Old problem everybody's tired of hearing of. There are three types of web pages. Don...

Personally I'm not a big fan of timing attack  as I believe they are impractical for web apps (while perfectly useful in other fields). ...

Hey, so called covert redirect  was all over the news today. I was asked by our client Auth0 if everything is ok with them - they are alrig...

Paperclip  is the most popular upload tool for Ruby on Rails, and I found a way to upload a file with arbitrary extension, which can lead to...

This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...

From official doc on Cross Origin Resource Sharing A  header  is said to be a  simple header  if the header field name is an  ASCII case-...

TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying o...

Try to run this simple app: require 'sinatra' get '/' do   redirect params[:to] if params[:to].start_with? 'http://...

TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will k...

If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* ...

TL;DR ///host.com is parsed as relative-path URL by server side libraries, but Chrome and Firefox violate RFC and load http://host.com inst...

TL;DR How can we use technique created to protect websites for Evil? (We used XSS Auditor for Evil before) There's a neat way: taking...