Web App Security Reading - 20150724

I was on a boring conference call this morning and noticed I'd accumulated quite a glut of WebAppSec reading links. I figured I'd dump them here for people to peruse and give me a way to cleanup my bookmarks :)

WebAppSec:

• XSS Vulnerability Shows How Security Issues Can Creep into Popular Software
• Sector Presentations (2014) 
• Generic XXE Detection 
• Hacking HTTPS -> HTTP referrers 
• Referrer CSRF Bypass ( Not Effective But Alternative ) 
• Playing with Content-Type – XXE on JSON Endpoints 
• Clickjacking with Jack 
• Your Application Security Program: Flawless Logic for Big Savings 
• 5 Steps for a Winning AppSec Program 
• SAML
• On Breaking SAML: Be Whoever You Want to Be 
• OWASP : Auth Cheat Sheet : SAML 
• ZAP SAML Extension (2yrs old as of 201507) 
• Cookie Bombing
• Browser Cookie Limits
• DoS attack on CDN users
• Cookie Bomb or let's break the Internet
• The maximum total HTTP header length for BIG-IP WebAccelerator and BIG-IP AAM is now 16,384 bytes
• Practical HTTP Host header attacks 
• Cross-Site Trust Exploitation (XSTE/CSTE) (Content Injection/Spoofing)
• Detecting low entropy tokens with massive bloom filters in Burp

 
Other:

• BSides Vancouver youtube Channel
• Make Your Images Interactive
• Interruption Science  
• Neural Computation and Adaptive Perception - Summer School 2014
• CrowdTesting
• uTest 
• PassBrains
• MobileSec
• Introducing the iOS Reverse Engineering Toolkit 
• OWASP iGoat 
• New X-Ray Android Security App Scans Devices For Vulnerabilities
• Poking Around in Android Memory
• Secure your mobile applications
• Android Application Assessment
• Intentional Evil: A Pen Tester's Overview of Android Intents
• IOS Application security Part 1 – Setting up a mobile pentesting platform
• IOS Application security Part 2 – Getting class information of IOS apps
• IOS Application security Part 3 – Understanding the Objective-C Runtime 
• iOS Application Security Part 4 – Runtime Analysis Using Cycript (Yahoo Weather App) 
• IOS Application security Part 5 – Advanced Runtime analysis and manipulation using Cycript (Yahoo Weather App)
• IOS Application Security Part 6 – New Security Features in IOS 7 
• Unearthing the hidden shortcomings in Aussie mobile app security 
• Creating a iOS7 Application Pentesting Environment
• Python 2.5’s “partition” saves my bacon