mozilla (firefox) - add ons

[1] AMO - Clickjacking Defense - Declarative Sec Detector

The X-FRAME-OPTIONS sets a restriction on the framing of a web page for a particular domain. It uses the value DENY and SAMEORIGIN for rendering the contents into a child frame. It is possible to stop the rendering completely in a child frame using DENY as a parameter. The SAMEORIGIN parameter declares that the content can only come from the parent site and that no third party content rendering is allowed. This addon scans all the HTTP response headers that accompany with the web page and raises a notification in the status bar showing whether the declarative security for Clickjacking is applied on the respective domain or not.

Download – Firefox Addon | SoftPedia Mirror

[2] AMO - HTTP Content Security Policy Detector

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP is designed to be fully backward compatible; browsers that don’t support it still work with servers that implement it, and vice-versa. Browsers that don’t support CSP simply ignore it, functioning as usual, defaulting to the standard same-origin policy for web content.

Download – Firefox Addon | SoftPedia Mirror

Note: AMO’s are in Experimental Phases (Verified by Mozilla).

For any feedback, send an email to 0kn0ck [No spam] secniche.org

supporting research

[1] Paper - The conundrum of declarative security HTTP response headers: lessons learned

The stringency of attacks has grown simultaneously with the development of the web. To combat some of the new attacks, declarative security has been proposed in the form of HTTP response headers from the server side. The declarative model provides an extensible set of security parameters in form of HTTP responses. In this, browsers can respond with a requested security mechanism. This paper explores the state of HTTP declarative security and how it is being applied today.

ACM Library | USENIX CollSec

[1] Paper - The state of HTTP declarative security in online banking websites

The banking industry is grappling with the problem of malware infections in clients. The exploitation of web vulnerabilities in a bank’s website can expose online monetary transactions to fraud. Vulnerabilities such as Cross-Site Scripting (XSS), clickjacking, MIME sniffing and Cross-Site Request Forgery (CSRF) allow information in one session to be stolen from another. However, browser security can play a critical role in preventing successful exploitation.

Elsevier – Computer, Fraud and Security (CFS) Journal (Releasing Soon)

declarative security - browsers

Home

CSD – Michigan State University

Dr. Richard J Enbody

Linked IN

Thanks to Gary McGraw for continuous discussions and support.The addons are an outcome of my work at Cigital Inc.

find more latest online casino information here: Sport777