Egor Homakov

Hey, so called covert redirect  was all over the news today. I was asked by our client Auth0 if everything is ok with them - they are alrig...

Paperclip  is the most popular upload tool for Ruby on Rails, and I found a way to upload a file with arbitrary extension, which can lead to...

This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...

From official doc on Cross Origin Resource Sharing A  header  is said to be a  simple header  if the header field name is an  ASCII case-...

TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying o...

Try to run this simple app: require 'sinatra' get '/' do   redirect params[:to] if params[:to].start_with? 'http://...

TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will k...

If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* ...

TL;DR ///host.com is parsed as relative-path URL by server side libraries, but Chrome and Firefox violate RFC and load http://host.com inst...

TL;DR How can we use technique created to protect websites for Evil? (We used XSS Auditor for Evil before) There's a neat way: taking...

Remember OAuth1 session fixation? No? Read writeup from Eran Hammer (the guy who hates OAuth2 as much as I do). Guess what - there's ...

TL;DR: In Firefox regexps with 999 998+ groups  return false, no matter was the given string valid or not. It seems like a performance opti...

I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button...

I wrote about this problem in May, without showcases, just a theoretical post  http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techn...