Aplicaciones Moviles Gratis, Seguridad, Tecnologia, Android, Apple: Hacking

<div style="text-align: justify;">
Como todos los años, WhiteHat Security (la empresa fundada en 2001 por Jeremiah Grossman) lleva a cabo un concurso con las mejores técnicas de hacking web del año.
 Las votaciones a los nuevos y creativos métodos suelen ser en dos 
fases: la primera abierta a la Comunidad y la segunda en la que un 
(impresionante) jurado elige las mejores en base a los resultados de la 
primera.  </div>
<div style="text-align: justify;">
 </div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRBxLw8KQ2OcKEfCg0RhLy8-ucalSbaay-uPeJTmrB2ogM1JPoXwP-7eoSN10FlRqpDl3BDzzajQESFjL7wsZoj1JeOxm6Knu08-cvXdH4J1B6LI3-O8eE3j27rsNYQkStIURUaczj-w9o/s1600/ninja_hacker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRBxLw8KQ2OcKEfCg0RhLy8-ucalSbaay-uPeJTmrB2ogM1JPoXwP-7eoSN10FlRqpDl3BDzzajQESFjL7wsZoj1JeOxm6Knu08-cvXdH4J1B6LI3-O8eE3j27rsNYQkStIURUaczj-w9o/s1600/ninja_hacker.jpg" /></a></div>
<div style="text-align: justify;">
 </div>
<div style="text-align: justify;">
  
Ahora por fin, tenemos los ganadores de las mejores técnicas del 2013:
 
</div>
<h2>
El Top 10</h2>
<ol>
<li><a href="https://www.hackinparis.com/talk-mario-heiderich" target="_blank"">Mario Heiderich – Mutation XSS</a></li>
<li><a href="http://threatpost.com/breach-compression-attack-steals-https-secrets-in-under-30-seconds/101579" target="_blank"">Angelo Prado, Neal Harris, Yoel Gluck – BREACH</a></li>
<li><a href="http://contextis.co.uk/research/white-papers/pixel-perfect-timing-attacks-html5/" target="_blank">Pixel Perfect Timing Attacks with HTML5</a></li>
<li><a href="http://www.isg.rhul.ac.uk/tls/Lucky13.html" target="_blank"">Lucky 13 Attack</a></li>
<li><a href="http://www.isg.rhul.ac.uk/tls/" target="_blank"">Weaknesses in RC4</a></li>
<li><a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf" target="_blank"">Timur Yunusov and Alexey Osipov – XML Out of Band Data Retrieval</a></li>
<li>Million Browser Botnet <a href="https://www.youtube.com/watch?v=ERJmkLxGRC0" target="_blank">Video</a> <a href="http://blackhat.com/us-13/briefings.html#Grossman" target="_blank">Briefing</a>
<a href="http://www.slideshare.net/jeremiahgrossman/million-browser-botnet" target="_blank">Slideshare</a></li>
<li><a href="http://ben-stock.de/wp-content/uploads/domxss.pdf" target="_blank"">Large Scale Detection of DOM based XSS</a></li>
<li><a href="https://blog.whitehatsec.com/tor-hidden-service-passive-de-cloaking/" target="_blank">Tor Hidden-Service Passive De-Cloaking</a></li>
<li><a href="http://feross.org/fill-disk/" target="_blank">HTML5 Hard Disk Filler™ API</a></li>
<a href="https://www.blogger.com/null" name="more"></a></ol>
Lista completa de 2013 (sin un orden en particular): 


<ol>
<li><a href="https://blog.whitehatsec.com/tor-hidden-service-passive-de-cloaking/" target="_blank">Tor Hidden-Service Passive De-Cloaking</a></li>
<li><a href="https://blog.whitehatsec.com/top-3-proxy-issues-that-no-one-ever-told-you/" target="_blank">Top 3 Proxy Issues That No One Ever Told You</a></li>
<li><a href="https://blog.whitehatsec.com/gravatar-email-enumeration-in-javascript/" target="_blank">Gravatar Email Enumeration in JavaScript</a></li>
<li><a href="http://contextis.co.uk/research/white-papers/pixel-perfect-timing-attacks-html5/" target="_blank">Pixel Perfect Timing Attacks with HTML5</a></li>
<li>Million Browser Botnet <a href="https://www.youtube.com/watch?v=ERJmkLxGRC0" target="_blank">Video</a> <a href="http://blackhat.com/us-13/briefings.html#Grossman" target="_blank">Briefing</a>
<a href="http://www.slideshare.net/jeremiahgrossman/million-browser-botnet" target="_blank">Slideshare</a></li>
<li><a href="https://yoast.com/research/autocompletetype.php" target="_blank">Auto-Complete Hack by Hiding Filled in Input Fields with CSS</a></li>
<li><a href="http://arstechnica.com/science/2013/02/site-plagiarizes-blog-posts-then-files-dmca-takedown-on-originals/" target="_blank">Site Plagiarizes Blog Posts, Then Files DMCA Takedown on Originals</a></li>
<li><a href="https://blog.whitehatsec.com/the-case-of-an-unconventional-csrf-attack-in-firefox/" target="_blank">The Case of the Unconventional CSRF Attack in Firefox</a></li>
<li><a href="http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/" target="_blank">Ruby on Rails Session Termination Design Flaw</a></li>
<li><a href="http://feross.org/fill-disk/" target="_blank">HTML5 Hard Disk Filler™ API</a></li>
<li><a href="https://groups.google.com/forum/?fromgroups=#%21topic/rubyonrails-security/KtmwSbEpzrU" target="_blank"">Aaron Patterson – Serialized YAML Remote Code Execution</a></li>
<li><a href="http://threatpost.com/java-zero-day-procession-continues-030113/77575" target="_blank"">Fireeye – Arbitrary reading and writing of the JVM process</a></li>
<li><a href="https://www.youtube.com/watch?v=eHSNT8vWLfc" target="_blank"">Timothy Morgan – What You Didn’t Know About XML External Entity Attacks</a></li>
<li><a href="http://threatpost.com/breach-compression-attack-steals-https-secrets-in-under-30-seconds/101579" target="_blank"">Angelo Prado, Neal Harris, Yoel Gluck – BREACH</a></li>
<li><a href="http://threatpost.com/patches-for-django-framework-fix-dos-vulnerability/102323" target="_blank"">James Bennett – Django DOS</a></li>
<li><a href="https://superevr.com/blog/2013/dont-use-linksys-routers/" target="_blank"">Phil Purviance – Don’t Use Linksys Routers</a></li>
<li><a href="https://www.hackinparis.com/talk-mario-heiderich" target="_blank"">Mario Heiderich – Mutation XSS</a></li>
<li><a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf" target="_blank"">Timur Yunusov and Alexey Osipov – XML Out of Band Data Retrieval</a></li>
<li><a href="https://blog.whitehatsec.com/internet-explorer-xss-filter" target="_blank"">Carlos Munoz – Bypassing Internet Explorer’s Anti-XSS Filter</a></li>
<li><a href="http://threatpost.com/some-netgear-routers-open-to-remote-authentication-bypass-command-injection/102689" target="_blank"">Zach Cutlip – Remote Code Execution in Netgear routers</a></li>
<li><a href="http://www.tripwire.com/state-of-security/top-security-stories/verizon-wirelesss-customer-portal-exposed-text-messages/" target="_blank"">Cody Collier – Exposing Verizon Wireless SMS History</a></li>
<li><a href="http://www.agarri.fr/blog/" target="_blank"">Compromising an unreachable Solr Serve</a></li>
<li><a href="http://averagesecurityguy.info/2013/11/08/finding-weak-rails-security-tokens/" target="_blank"">Finding Weak Rails Security Tokens</a></li>
<li><a href="http://slid.es/mscasharjaved/trusted-friend-attack" target="_blank"">Ashar Javad Attack against Facebook’s password reset process.</a></li>
<li><a href="http://threatpost.com/father-daughter-hacking-team-finds-valuable-facebook-bug/102877" target="_blank"">Father/Daughter Team Finds Valuable Facebook Bug</a></li>
<li><a href="http://arstechnica.com/security/2013/03/guerilla-researcher-created-epic-botnet-to-scan-billions-of-ip-addresses/" target="_blank"">Hacker scans the internet</a></li>
<li><a href="http://ben-stock.de/wp-content/uploads/dns-rebinding.pdf" target="_blank"">Eradicating DNS Rebinding with the Extended Same-Origin Policy</a></li>
<li><a href="http://ben-stock.de/wp-content/uploads/domxss.pdf" target="_blank"">Large Scale Detection of DOM based XSS</a></li>
<li><a href="https://communities.coverity.com/blogs/security/2013/05/29/struts2-remote-code-execution-via-ognl-injection" target="_blank"">Struts 2 OGNL Double Evaluation RCE</a></li>
<li><a href="http://www.isg.rhul.ac.uk/tls/Lucky13.html" target="_blank"">Lucky 13 Attack</a></li>
<li><a href="http://www.isg.rhul.ac.uk/tls/" target="_blank"">Weaknesses in RC4</a></li>
</ol>
Resultados de años anteriores: <a href="http://jeremiahgrossman.blogspot.com/2006/12/top-10-web-hacks-of-2006.html" target="_blank">2006</a> (65), <a href="http://jeremiahgrossman.blogspot.com/2008/01/top-ten-web-hacks-of-2007-official.html" target="_blank">2007</a> (83), <a href="http://jeremiahgrossman.blogspot.com/2009/02/top-ten-web-hacking-techniques-of-2008.html" target="_blank">2008</a> (70), <a href="http://jeremiahgrossman.blogspot.com/2010/01/top-ten-web-hacking-techniques-of-2009.html" target="_blank">2009</a> (82), <a href="http://jeremiahgrossman.blogspot.com/2011/01/top-ten-web-hacking-techniques-of-2010.html" target="_blank">2010</a> (69), <a href="https://blog.whitehatsec.com/vote-now-top-ten-web-hacking-techniques-of-2011/" target="_blank">2011</a> (51) y <a href="https://blog.whitehatsec.com/top-ten-web-hacking-techniques-of-2012/" target="_blank">2012</a> (56).
 
   
Más información de las votaciones de 2013: <a href="http://blog.whitehatsec.com/top-10-web-hacking-techniques-2013/">http://blog.whitehatsec.com/top-10-web-hacking-techniques-2013/</a>

Las 10 mejores técnicas de hacking web en el 2013

Como todos los años, WhiteHat Security (la empresa fundada en 2001 por Jeremiah Grossman) lleva a cabo un concurso con las mejores técnica...

Hacking a PIN de Cajeros

Las 10 mejores técnicas de hacking web en el 2013