John Cox · Tagged xss

Box Tech Blog » Securing jQuery against unintended XSS

This document contains Box's Privacy Policy (dated August 2009) and Enterprise License Agreement (dated August 2010), outlining how the company collects and uses user data and the terms under which businesses can license its cloud storage service. The privacy policy explains that Box collects personal information through user registration, automatically via browser data and cookies, and uses it for service improvement, marketing, and customer support, while aggregate data can be shared with third parties; the company stores data in the US and other countries under Safe Harbor principles and takes reasonable security measures, though it does not guarantee protection of all information. The enterprise agreement grants customers a non-exclusive license to provide file storage and sharing to authorized users through Box's hosted service, with terms covering account management, fees, intellectual property warranties, liability limitations, and dispute resolution under California law, while explicitly prohibiting modification, reverse engineering, or resale of the licensed product.

Permalink security tutorial jquery xss

Untitled (http://ha.ckers.org/xss.html)

This is a comprehensive technical reference guide for XSS filter evasion techniques, cataloging dozens of methods attackers can use to bypass security filters and inject malicious scripts into vulnerable web applications. The guide covers obfuscation strategies like HTML entity encoding, Unicode variations, character insertion techniques, and exploitation of browser parsing differences across Internet Explorer, Firefox, Opera, and Netscape. Rather than teaching attack execution or defense, it documents the underlying methodologies of how various encoding tricks, whitespace manipulation, and browser-specific quirks can defeat content filters—serving primarily as educational material for security researchers understanding XSS attack vectors.