security.web-applications (thread)

Google using Expired Cert and SSLv2, Matthew S. Hamrick
Further Thoughts about Benchmarking, Mark Curphey
Evading Client-Certificate Authentication, Kevin Vanhaelen
- Re: Evading Client-Certificate Authentication, Skip Carter
Administrivia, Mark Curphey
improvements in session management?, flatline
- RE: improvements in session management?, WebAppSecurity [Technicalinfo.net]
  - Re: improvements in session management?, Mark Foster
    - RE: improvements in session management?, WebAppSecurity [Technicalinfo.net]
    - Re: improvements in session management?, Mark Foster
White Paper - Web Application Worms: Myth or Reality?, Imperva Application Defense Center
- Re: White Paper - Web Application Worms: Myth or Reality?, Daniel
- RE: White Paper - Web Application Worms: Myth or Reality?, stephen
- RE: White Paper - Web Application Worms: Myth or Reality?, Amichai Shulman
- RE: White Paper - Web Application Worms: Myth or Reality?, Amichai Shulman
OASIS WAS Thesaurus (coming soon), Mark Curphey
Authenticating a web server, Amit Sharma
- Re: Authenticating a web server, Steve Suehring
- RE: Authenticating a web server, Imperva Application Defense Center
Stack overflow blocking in commercial packages, Glenn_Everhart
- Re: Stack overflow blocking in commercial packages, exon
- RE: Stack overflow blocking in commercial packages, Glenn_Everhart
Blogger XSS Vulnerability, Ferruh Mavituna
- Blogger XSS Vulnerability, Ferruh Mavituna
RE: A new Sanctum white paper: "Divide and Conquer - HTTP Respons e Splitting, Web Cache Poisoning Attacks, and Related Topics", Weiler, Jim
VB: [VulnWatch] Remotely Exploitable Cross-Site Scripting in Hotmail and Yahoo (GM#005-MC), Ulf Härnhammar
SSL version selection query, Abhishek Kumar
- RE: SSL version selection query, Bénoni MARTIN
Paros v3.1.1 released, contact
Penetration Testing Report - Sample Report, Ofer Maor
Burp spider v1.0 released, PortSwigger
XSS and hijacking vuln at phpgroupware, Hokkaido
secure software engineering methodology, Mads Rasmussen
- Re: secure software engineering methodology, Alex Russell
  - Re: secure software engineering methodology, Mads Rasmussen
- Re: secure software engineering methodology, Gunnar Peterson
OWASP Web Application Pen Testing Check List, Mark Curphey
- RE: OWASP Web Application Pen Testing Check List, Gaydosh, Adam
OASIS WAS Classification Scheme, Mark Curphey
- RE: OASIS WAS Classification Scheme, Larry Guger
Re: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Charlie Cano
testing web app security, Michael Cunningham
- Re: testing web app security, A.D. Douma
  - Re: testing web app security, Ivan Ristic
- Re: testing web app security, Felipe Moniz de Aragao
- RE: testing web app security, Mark Curphey
- Re: testing web app security, Steve Suehring
- RE: testing web app security, Weiler, Jim
WebScarab updated, Rogan Dawes
Security using Apache module, stevenr
- Re: Security using Apache module, chorn
- Re: Security using Apache module, Ivan Ristic
- RE: Security using Apache module, stevenr
  - Re: Security using Apache module, Ivan Ristic
- RE: Security using Apache module, Calderon, Juan Carlos (GE Commercial Finance, NonGE)
xxs problem - character problems, Frank Dobb
xxs problem, Frank Dobb
- Re: xxs problem, Clint Bodungen
- RE: xxs problem, Dean Saxe
- RE: xxs problem, Michael Silk
Stealing Passwords via browser refresh, Karmendra Kohli
MS SQL Inter-database query question, Michael Silk
- Re: MS SQL Inter-database query question, Adam Tuliper
- Re: MS SQL Inter-database query question, Marlon Jabbur
- RE: MS SQL Inter-database query question, Harshul Nayak
- RE: MS SQL Inter-database query question, Michael Howard
Tomcat on port 80 or Java as root, Rajkumar S
- RE: Tomcat on port 80 or Java as root, Harshul Nayak
  - Re: Tomcat on port 80 or Java as root, Rajkumar S
  - Re: Tomcat on port 80 or Java as root, Aleksi Kallio
- Re: Tomcat on port 80 or Java as root, Dave Ockwell-Jenner
- Re: Tomcat on port 80 or Java as root, David Wall @ Yozons, Inc.
- Re: Tomcat on port 80 or Java as root, George Georgalis
- RE: Tomcat on port 80 or Java as root, urgoez
- Re: Tomcat on port 80 or Java as root, Daniel
- RE: Tomcat on port 80 or Java as root, Marc Deglos
  - Re: Tomcat on port 80 or Java as root, Rajkumar S
  - Re: Tomcat on port 80 or Java as root, Grega Bremec
- RE: Tomcat on port 80 or Java as root, Martin Gil
- Re: Tomcat on port 80 or Java as root, d31ik47
- Re: Tomcat on port 80 or Java as root, Daniel
- Re: Tomcat on port 80 or Java as root, Daniel
How do you measure software security issues in web applications ?, Mark Curphey
RE: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Amit Klein
RE: Security tool for monitoring HTTPS traffic?, Amichai Shulman
- RE: Security tool for monitoring HTTPS traffic?, Yoram Zahavi
  - Re: Security tool for monitoring HTTPS traffic?, Romain Vergniol
- RE: Security tool for monitoring HTTPS traffic?, David Wong
A new Sanctum white paper: "Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", Amit Klein
- Re: A new Sanctum white paper: "Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", Jeremiah Grossman
  - Re: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and session fixation, Peter Watkins
- RE: A new Sanctum white paper: "Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", Amit Klein
- RE: A new Sanctum white paper: "Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", Amit Klein
Announcing The Black Hat Briefings call for papers, Jeff Moss
Re: Where do You Architect Security in An Application (Was HTTPS Security Moniting Tools), Jeff Williams
Re: Innocent Code Prize for Best Post on WebAppSec, Sverre H. Huseby
- Re: Innocent Code Prize for Best Post on WebAppSec, Sverre H. Huseby
- Re: Innocent Code Prize for Best Post on WebAppSec, Sverre H. Huseby
Re: Controlling access to pdf/doc files (db "better" than filesystem?), David Cameron