security.web-applications (date)

March 31, 2004

Google using Expired Cert and SSLv2, Matthew S. Hamrick
Further Thoughts about Benchmarking, Mark Curphey
RE: improvements in session management?, WebAppSecurity [Technicalinfo.net]
Re: Evading Client-Certificate Authentication, Skip Carter
Re: improvements in session management?, Mark Foster
Evading Client-Certificate Authentication, Kevin Vanhaelen
Administrivia, Mark Curphey
Re: improvements in session management?, Mark Foster
RE: improvements in session management?, WebAppSecurity [Technicalinfo.net]
RE: testing web app security, Weiler, Jim
improvements in session management?, flatline
RE: White Paper - Web Application Worms: Myth or Reality?, Amichai Shulman
RE: White Paper - Web Application Worms: Myth or Reality?, Amichai Shulman
RE: White Paper - Web Application Worms: Myth or Reality?, stephen
Re: White Paper - Web Application Worms: Myth or Reality?, Daniel

March 30, 2004

White Paper - Web Application Worms: Myth or Reality?, Imperva Application Defense Center
RE: Stack overflow blocking in commercial packages, Glenn_Everhart

March 29, 2004

RE: OWASP Web Application Pen Testing Check List, Gaydosh, Adam
OASIS WAS Thesaurus (coming soon), Mark Curphey

March 28, 2004

Re: Authenticating a web server, Steve Suehring
RE: Authenticating a web server, Imperva Application Defense Center
Authenticating a web server, Amit Sharma
Re: Stack overflow blocking in commercial packages, exon

March 26, 2004

Stack overflow blocking in commercial packages, Glenn_Everhart
Blogger XSS Vulnerability, Ferruh Mavituna
Blogger XSS Vulnerability, Ferruh Mavituna

March 25, 2004

March 24, 2004

VB: [VulnWatch] Remotely Exploitable Cross-Site Scripting in Hotmail and Yahoo (GM#005-MC), Ulf Härnhammar

March 23, 2004

RE: SSL version selection query, Bénoni MARTIN
SSL version selection query, Abhishek Kumar
Paros v3.1.1 released, contact
Re: secure software engineering methodology, Mads Rasmussen
Re: secure software engineering methodology, Gunnar Peterson
Re: secure software engineering methodology, Alex Russell
Penetration Testing Report - Sample Report, Ofer Maor
Burp spider v1.0 released, PortSwigger

March 22, 2004

XSS and hijacking vuln at phpgroupware, Hokkaido
secure software engineering methodology, Mads Rasmussen

March 20, 2004

Re: testing web app security, Ivan Ristic
RE: OASIS WAS Classification Scheme, Larry Guger
Re: testing web app security, Steve Suehring

March 19, 2004

OWASP Web Application Pen Testing Check List, Mark Curphey
OASIS WAS Classification Scheme, Mark Curphey
RE: testing web app security, Mark Curphey
Re: testing web app security, Felipe Moniz de Aragao
Re: testing web app security, A.D. Douma
Re: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Charlie Cano
testing web app security, Michael Cunningham
RE: Security using Apache module, Calderon, Juan Carlos (GE Commercial Finance, NonGE)
Re: Security using Apache module, Ivan Ristic
WebScarab updated, Rogan Dawes
Re: Security using Apache module, Ivan Ristic
Re: Security using Apache module, chorn
RE: Security using Apache module, stevenr

March 18, 2004

Security using Apache module, stevenr

March 17, 2004

RE: xxs problem, Michael Silk
Re: xxs problem, Clint Bodungen

March 16, 2004

xxs problem - character problems, Frank Dobb
RE: xxs problem, Dean Saxe
xxs problem, Frank Dobb

March 15, 2004

Stealing Passwords via browser refresh, Karmendra Kohli
RE: MS SQL Inter-database query question, Harshul Nayak
RE: MS SQL Inter-database query question, Michael Howard
Re: MS SQL Inter-database query question, Marlon Jabbur
Re: MS SQL Inter-database query question, Adam Tuliper

March 14, 2004

MS SQL Inter-database query question, Michael Silk
Re: Tomcat on port 80 or Java as root, Grega Bremec

March 13, 2004

Re: Innocent Code Prize for Best Post on WebAppSec, Sverre H. Huseby
Re: Tomcat on port 80 or Java as root, Daniel
RE: Tomcat on port 80 or Java as root, urgoez
Re: Tomcat on port 80 or Java as root, Daniel
Re: Tomcat on port 80 or Java as root, d31ik47
Re: Tomcat on port 80 or Java as root, George Georgalis
RE: Tomcat on port 80 or Java as root, Martin Gil
Re: Tomcat on port 80 or Java as root, David Wall @ Yozons, Inc.
Re: Tomcat on port 80 or Java as root, Aleksi Kallio
Re: Tomcat on port 80 or Java as root, Rajkumar S
Re: Tomcat on port 80 or Java as root, Dave Ockwell-Jenner
Re: Tomcat on port 80 or Java as root, Rajkumar S

March 12, 2004

RE: Tomcat on port 80 or Java as root, Marc Deglos
Re: Tomcat on port 80 or Java as root, Daniel
RE: Tomcat on port 80 or Java as root, Harshul Nayak

March 11, 2004

Tomcat on port 80 or Java as root, Rajkumar S
RE: Security tool for monitoring HTTPS traffic?, David Wong

March 10, 2004

Re: Security tool for monitoring HTTPS traffic?, Romain Vergniol
RE: Security tool for monitoring HTTPS traffic?, Yoram Zahavi

March 08, 2004

How do you measure software security issues in web applications ?, Mark Curphey

March 07, 2004

RE: A new Sanctum white paper: "Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", Amit Klein
RE: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Amit Klein
RE: Security tool for monitoring HTTPS traffic?, Amichai Shulman

March 06, 2004

Re: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Peter Watkins

March 05, 2004

March 04, 2004

Announcing The Black Hat Briefings call for papers, Jeff Moss

March 02, 2004

Re: Where do You Architect Security in An Application (Was HTTPS Security Moniting Tools), Jeff Williams
Re: Innocent Code Prize for Best Post on WebAppSec, Sverre H. Huseby
Re: Controlling access to pdf/doc files (db "better" than filesystem?), David Cameron