Skip to content

Commit

Permalink
testing
Browse files Browse the repository at this point in the history
  • Loading branch information
blabla1337 committed Nov 6, 2019
1 parent 54a2418 commit 9d42687
Show file tree
Hide file tree
Showing 4 changed files with 9 additions and 9 deletions.
4 changes: 3 additions & 1 deletion skf/api/chatbot/dataset_prepare/data.py
Expand Up @@ -35,14 +35,16 @@ def desc_sol_data():
a=data['items']
for i,value in enumerate(a):
file_des_sol.write("{\n")
file_des_sol.write('"kbId": '+str(a[i]['kbID'])+",\n")
file_des_sol.write('"kbId": '+str(a[i]['kb_id'])+",\n")
file_des_sol.write('"title": "'+ a[i]['title']+'",\n')
y=a[i]['content']
y=y.replace("\n\n","")
y=y.replace("\n\n\n","")
y=y.replace("\n"," ")
y=y.split("Solution:")
y[0]=y[0].split("Description:")
print(a[i]['kb_id'])
print(json.dumps(y[0][1]))
file_des_sol.write('"Description": '+json.dumps(y[0][1])+",\n")
if (i+1)<len(a):
file_des_sol.write('"Solution": '+json.dumps(y[1])+"\n},\n")
Expand Down
Expand Up @@ -3,8 +3,7 @@
Reverse tabnabbing is an attack where a page linked from the target page is able to rewrite that page,
for example to replace it with a phishing site. As the user was originally on the correct page they are
less likely to notice that it has been changed to a phishing site, especially it the site looks the same as the target.
If the user authenticates to this new page then their credentials (or other sensitive data) are sent to the phishing site
rather than the legitimate one.
If the user authenticates to this new page then their credentials (or other sensitive data) are sent to the phishing site rather than the legitimate one.

As well as the target site being able to overwrite the target page, any http link can be spoofed to overwrite the target
page if the user is on an unsecured network, for example a public wifi hotspot. The attack is possible even if the target
Expand Down Expand Up @@ -37,5 +36,4 @@ link or javascript to open a window (or tab) then use this configuration to maxi
}

Add the HTTP response header Referrer-Policy: no-referrer the every HTTP responses send by the application
(Header Referrer-Policy information). This configuration will ensure that no referrer information is sent
along with requests from page.
(Header Referrer-Policy information). This configuration will ensure that no referrer information is sent along with requests from page.
@@ -1,4 +1,4 @@
## Description
## Description:

Whenever user supplied input is embeded directly into a template when the application
makes use of a templeating engine (jinja2, twig, Freemarker), a malicious attacker can inject
Expand All @@ -9,7 +9,7 @@ This type of vulnerability is also seen a lot through applications that let the
modify the template to provide users a more flexible way to style the applications pages like
a wiki page or CMS system.

## Solution
## Solution:

User supplied input should never be used directly into a template that uses a templating engine.
The following example is a small python flask function that renders user supplied input
Expand Down
@@ -1,4 +1,4 @@
## Description
## Description:

Type checking, length checking and whitelisting is an essential in defense in depth strategie to make
your application more resiliant against input injection attacks.
Expand All @@ -16,7 +16,7 @@ the $_GET['id'] parameter was indeed as expected an integer and rejected if this
the attack would effectively been mitigated.


## Solution
## Solution:

All the user supplied input that works outside of the intended opteration of the application
should be rejected by the application.
Expand Down

0 comments on commit 9d42687

Please sign in to comment.