#Learn365 Day-6: Cross-Site Leaks

Goldmine to Learn: https://t.co/TsqGRWxPq7

Cross-Site Leaks/XS-Leaks is a less explored security issue that usually comes from Side-Channel Attacks. I found this an interesting vector but unusual.

(1/n)

#BugBountyTips #infosec #AppSec

(2/n)
This basically utilizes the web's core principle of composability in order to determine & extract useful information.

XS-Leaks take advantage of small pieces of information that are exposed during interactions between websites.
(3/n)
Cross-Site Oracle.

This can be considered as a querying mechanism. The information used for this attack is of binary form and called Oracles. It usually has an answer of "Yes" or "No". You can say True or False.
(4/n)
For Example: Does User Harsh Exists in the Application. Yes, means that the user is there in the application.
- An attacker requires to smartly form queries in order to successfully execute this attack and gain hold of sensitive information.
(5/n)
Some of the Attacks using Cross-Site leaks are:

1. XS-Search: An attacker try to abuse the query mechanism such as search functionality to leak and get hold of the user's information.

Remediation
- Same Site Lax Cookies
(6/n)
Usual Exploitation Workflow:

1. Define a timeline when there is a Hit vs Miss
2. Start attacking the Querying Endpoint.
3. For Example: ?search=h (Throws a Hit)
search for the next word appended to `h` i.e. ?search=ha otherwise change the word i.e. ?search=b
(7/n)
2. Error Events

Based on the Error Message returned by the application, it may be possible to enumerate sensitive information. This is similar to user enumeration techniques.

Reference: https://t.co/2iIVT0xei2
(8/n)
3. Frame Counting
The window.length provides the number of frames in the window. This attribute can provide valuable information about a page to an attacker.

References: https://t.co/XjOZL3yiZF
(9/n)
3. Navigation Attacks
Reference: https://t.co/lS3LT80Foa

4. Cache Probing
- Workes based on detecting whether the web page was cached or not.
Ref: https://t.co/ejAdOHaIFG

5. ID Attribute
Ref: https://t.co/11lwLzE2DD
(10/n)

6. Post Message Broadcasts
a. Sharing Sensitive message with untrusted origins
b. Leaking information based on varying content or on the presence of a broadcast

7. Abusing Browser Features
- CORB (Cross-Origin Read Blocking)
- CORP (Cross-Origin Resource Policy)
(n/n)

8. Timing Attacks
- Clock Based
- Network Timing
- Execution Timing
- Hybrid Timing
- Connection Pool

# Referneces
1. https://t.co/byryqh3bql
2. https://t.co/khunvHYDga
3. https://t.co/ssQ39okO55

I'll revisit this attack in near future & will try to find.

More from For later read

Hi @EdinburghUni @EHRC @EHRCChair @KishwerFalkner @RJHilsenrath @trussliz @GEOgovuk

The DIVERSITY INFORMATION section in yr job application mentions 'legal equality duties'. You then ask "What is your gender identity?" with options

Female
Male
Non-binary
Not-listed
Other

1/13


'Gender identity' is not a protected characteristic under the Equality Act 2010 and is not defined in the Act.

https://t.co/qisFhCiV1u

2/13


Sex is the protected characteristic and the only two possible options for sex are 'Female' and 'Male' as defined in the Act and consistent with biology - 'non-binary' and 'other' are not valid options.

https://t.co/CEJ0gkr6nF

'Gender identity' is not a synonym for sex.

3/13


You then ask "Does your gender identity match your sex registered at birth?"

4/13


Again, 'gender identity' is not a protected characteristic under the Equality Act 2010 and is not defined in the Act.

https://t.co/qisFhCiV1u

5/13
Nice to discover Judea Pearl ask a fundamental question. What's an 'inductive bias'?


I crucial step on the road towards AGI is a richer vocabulary for reasoning about inductive biases.

explores the apparent impedance mismatch between inductive biases and causal reasoning. But isn't the logical thinking required for good causal reasoning also not an inductive bias?

An inductive bias is what C.S. Peirce would call a habit. It is a habit of reasoning. Logical thinking is like a Platonic solid of the many kinds of heuristics that are discovered.

The kind of black and white logic that is found in digital computers is critical to the emergence of today's information economy. This of course is not the same logic that drives the general intelligence that lives in the same economy.

You May Also Like

राम-रावण युद्ध समाप्त हो चुका था। जगत को त्रास देने वाला रावण अपने कुटुम्ब सहित नष्ट हो चुका था।श्रीराम का राज्याभिषेक हुआ और अयोध्या नरेश श्री राम के नेतृत्व में चारों दिशाओं में शन्ति थी।
अंगद को विदा करते समय राम रो पड़े थे ।हनुमान को विदा करने की शक्ति तो राम में थी ही नहीं ।


माता सीता भी हनुमान को पुत्रवत मानती थी। अत: हनुमान अयोध्या में ही रह गए ।राम दिनभर दरबार में, शासन व्यवस्था में व्यस्त रहते थे। संध्या को जब शासकीय कार्यों में छूट मिलती तो गुरु और माताओं का कुशल-मंगल पूछ अपने कक्ष में जाते थे। परंतु हनुमान जी हमेशा उनके पीछे-पीछे ही रहते थे ।


उनकी उपस्थिति में ही सारा परिवार बहुत देर तक जी भर बातें करता ।फिर भरत को ध्यान आया कि भैया-भाभी को भी एकांत मिलना चाहिए ।उर्मिला को देख भी उनके मन में हूक उठती थी कि इस पतिव्रता को भी अपने पति का सानिध्य चाहिए ।

एक दिन भरत ने हनुमान जी से कहा,"हे पवनपुत्र! सीता भाभी को राम भैया के साथ एकांत में रहने का भी अधिकार प्राप्त है ।क्या आपको उनके माथे पर सिन्दूर नहीं दिखता?इसलिए संध्या पश्चात आप राम भैया को कृप्या अकेला छोड़ दिया करें "।
ये सुनकर हनुमान आश्चर्यचकित रह गए और सीता माता के पास गए ।


माता से हनुमान ने पूछा,"माता आप अपने माथे पर सिन्दूर क्यों लगाती हैं।" यह सुनकर सीता माता बोलीं,"स्त्री अपने माथे पर सिन्दूर लगाती है तो उसके पति की आयु में वृद्धि होती है और वह स्वस्थ रहते हैं "। फिर हनुमान जी प्रभु राम के पास गए ।
I hate when I learn something new (to me) & stunning about the Jeff Epstein network (h/t MoodyKnowsNada.)

Where to begin?

So our new Secretary of State Anthony Blinken's stepfather, Samuel Pisar, was "longtime lawyer and confidant of...Robert Maxwell," Ghislaine Maxwell's Dad.


"Pisar was one of the last people to speak to Maxwell, by phone, probably an hour before the chairman of Mirror Group Newspapers fell off his luxury yacht the Lady Ghislaine on 5 November, 1991."
https://t.co/DAEgchNyTP


OK, so that's just a coincidence. Moving on, Anthony Blinken "attended the prestigious Dalton School in New York City"...wait, what? https://t.co/DnE6AvHmJg

Dalton School...Dalton School...rings a

Oh that's right.

The dad of the U.S. Attorney General under both George W. Bush & Donald Trump, William Barr, was headmaster of the Dalton School.

Donald Barr was also quite a


I'm not going to even mention that Blinken's stepdad Sam Pisar's name was in Epstein's "black book."

Lots of names in that book. I mean, for example, Cuomo, Trump, Clinton, Prince Andrew, Bill Cosby, Woody Allen - all in that book, and their reputations are spotless.