CYBER SECURITY IN MODERN WORLD

      Cybersecurity is the practice of protecting computers, networks, data, and digital systems from cyber threats such 
      hacking, malware, phishing, and data breaches. 
      In today's interconnected world, cybersecurity is essential for safeguarding personal information, business operations,   
      financial transactions, and critical infrastructure. 
      As technology advances, cyber attacks are becoming more sophisticated, making strong security measures increasingly 
      important.

      Transition to Quantum Security

     With the development of quantum computing, traditional encryption methods may become vulnerable because powerful 
     quantum computers could potentially break current cryptographic algorithms much faster than classical computers.
     Quantum security, also known as post-quantum cryptography, focuses on developing new encryption techniques that can
     resist attacks from both classical and quantum computers.
     This emerging field aims to ensure long-term data protection and secure communication in the future quantum era.

Stay Secure

Insights and tips on protecting your digital life every day.

Lab: Reflected XSS protected by CSP, with CSP bypass

This lab uses CSP and contains a reflected XSS vulnerability.

To solve the lab, perform a cross-site scripting attack that bypasses the CSP and calls the alert function.

https://portswigger.net

  • Enter the following into the search box:<img src=1 onerror=alert(1)>
  • Observe that the payload is reflected, but the CSP prevents the script from executing.
  • In Burp Proxy, observe that the response contains a Content-Security-Policy header, and the report-uri directive contains a parameter called token. Because you can control the token parameter, you can inject your own CSP directives into the policy.
  • The injection uses the script-src-elem directive in CSP. This directive allows you to target just script elements. Using this directive, you can overwrite existing script-src rules enabling you to inject unsafe-inline, which allows you to use inline scripts.