We've written a new guide on XS-Leaks:
https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XS-Leaks
Many thanks to @freddy, Hamish Willee, @MartinaKraus11, and @terjanq for your reviews and collaboration. #websecurity

We've written a new guide on XS-Leaks:
https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XS-Leaks
Many thanks to @freddy, Hamish Willee, @MartinaKraus11, and @terjanq for your reviews and collaboration. #websecurity
Which lesser-known Burp extensions do you swear by? Share your favorites below!
If you code in PHP, you code for security
Auth
Encryption
CSRF, headers, dependencies…
These are the must-know libraries for 2025 Full Article : https://medium.com/@mohamadshahkhajeh/top-php-security-libraries-you-should-know-in-2025-65a54fc6dc8d
Geeksta CyberLab | S1E3
Today, we’re diving into PortSwigger—exploring web security, breaking things (ethically), and learning how to patch them. If you're into cybersecurity, this one’s for you.
I’ll be live soon, feel free to drop by.
#Geeksta #CyberLab #Cybersecurity #PortSwigger #EthicalHacking #WebSecurity
Our 2nd Keynote is here!
We're excited to have Frederik Braun @freddy (Mozilla) at #MADWeb '25!
Join us in San Diego to attend this session!
Full program: https://madweb.work/#program
How advanced programmers monitor security logs to detect attacks
https://chat-to.dev/post?id=968 #hacker #websecurity #cybersecurity #programming #hacker
**DEX Exchange: What It Is and How to Get Started**
Decentralization is one of the key principles of the crypto industry, so it's no surprise that the popularity of De-Fi and decentralized exchanges (DEX) has been growing for several years. In this article, Trustee specialists will explain what decentralized cryptocurrency exchanges are, how they are regulated, how they differ from centralized exchanges, and how to start using them. Read on for an overview of their advantages and disadvantages, predicted future prospects, and a ranking of the best decentralized exchanges!
### What Is a DEX Exchange?
A decentralized exchange (DEX) is a platform for exchanging digital assets that operates based on decentralization—without central governance by an individual or group of people and without a central node or server.
Essentially, a DEX is a blockchain-based platform that facilitates peer-to-peer (P2P) transactions without intermediaries. It does not store user personal data or their financial information on its servers. Users exchange assets through smart contracts and algorithms based on a distributed ledger.
Many exchanges that call themselves decentralized actually store trading data and user order information on their servers, even though they do not hold private keys. The first efforts to create cryptocurrency DEXs emerged in 2014, but significant development only started in 2018.
### Regulation of DEXs
Governments have mixed opinions on financial-technology platforms that are governed solely by their user communities, with no central entity accountable for transactions.
As with cryptocurrency in general, authorities in different countries have not reached a consensus. For example, Singapore’s regulator seeks to develop a regulatory framework specifically for DEXs, while the U.S. attempts to apply existing laws.
In most countries, decentralized exchanges remain unregulated as they are not tied to any legal entities. This means that in case of violations, there is no single entity to hold accountable or to send official requests.
### How DEXs Work
Orders are executed on the blockchain using smart contracts. User funds remain on their own devices. While decentralized exchanges operate on various blockchains, the most popular ones use Tron, Ethereum, and Binance Chain.
A DEX serves as a marketplace for matching buy and sell orders. Once orders are matched, trading occurs directly between users.
### Pros and Cons of DEXs
**Advantages** | **Disadvantages**
--- | ---
No central governing authority; operates automatically or with community governance | No official customer support
Completely anonymous transactions | Difficulties converting fiat currencies
Secure data storage | Complex user interface, challenging for beginners
No need for user identification (KYC/AML) | No data recovery options for users
Fair pricing with no market manipulation | Trading limited to tokens that support smart contracts
Regulators cannot freeze accounts | Smaller liquidity pools compared to centralized exchanges
Transparent transactions | Limited functionality (e.g., no margin trading, stop-loss orders, leverage)
No counterparty risks | Potential smart contract vulnerabilities
Ability to trade tokens not listed on centralized exchanges | Slower trading speeds compared to centralized exchanges
No single point of failure |
### Differences Between Decentralized and Centralized Exchanges
The main difference is the absence of a central governing entity that controls user data and exchange operations. In DEXs, governance is automated or semi-automated, with community involvement in decision-making.
DEXs are more suitable for experienced traders. Users manage their own funds and trades without access to customer support or fund recovery options. While this ensures full control, it also places sole responsibility on the user. However, all transactions are fully transparent, as all activity can be tracked on the blockchain.
Centralized exchanges (CEXs) have tools for market manipulation and can freeze user accounts at any time due to "suspicious" activity. Additionally, since CEXs have legal addresses, government authorities in some jurisdictions can seize their assets, confiscate servers, and freeze user accounts. These actions are not possible on DEXs because their servers are distributed across various locations, placing them in a legal gray area.
### Examples of Decentralized Exchanges
The number of DEX platforms has significantly increased in recent years. Below are some of the most popular and highly rated decentralized cryptocurrency exchanges.
- **JustSwap** – A decentralized trading protocol on TRON for automated liquidity provision.
- **IDEX** – A real-time DEX for ERC-20 tokens on Ethereum with hardware wallet support and the ability to cancel orders without fees.
- **Waves DEX** – A cross-platform exchange built on the Waves blockchain that allows trading token pairs without needing an intermediary currency.
- **PancakeSwap** – A DEX on Binance Smart Chain (BSC) that supports BEP-20 token trading, liquidity rewards, and features NFT collections and lotteries.
- **Bancor Network** – A decentralized exchange with automatic pricing and no price difference between buy and sell orders.
- **Binance DEX** – A decentralized counterpart to Binance’s main exchange.
- **Uniswap** – A decentralized exchange on Ethereum featuring an automated liquidity protocol.
Decentralized exchanges are a cornerstone of the DeFi movement, offering enhanced security, transparency, and user control. However, they also present usability challenges and require users to take full responsibility for their funds. Understanding how DEXs operate and their key differences from centralized exchanges is essential for making informed decisions in crypto trading.
Here are 23 hashtags that you can use depending on the context or content you are sharing:
#technology
#security
#cryptocurrency
#privacy
#AI
#machinelearning
#innovation
#websecurity
#cybersecurity
#digitalprivacy
#virtualmachines
#linux
#wordpress
#cloudhosting
#internetofthings
#networking
#open-source
#cyberattack
#blockchain
#cryptotrading
#anonymity
#dataencryption
#futuretech
Let me know if you have a specific theme, and I can tailor the hashtags accordingly!
Just 4 days left to submit your papers to MadWeb! Remember, we welcome work-in-progress submissions, and you can opt out of proceedings if you're seeking feedback to refine and resubmit later!
Submit here: https://madweb25.hotcrp.com
Website: https://madweb.work
I’m excited to share my Stored XSS Testing Tool! This tool automates Stored XSS testing by injecting payloads and checking their persistence in web applications.
Check it out on GitHub: GitHub Repo
Looking forward to connecting with the cybersecurity community!
My First Post on Mastodon!
I’m excited to share my Reflected XSS Testing Tool with the community! This tool helps penetration testers automate Reflected XSS testing by injecting payloads and logging responses.
Features:
Fully Dockerized for portability
Predefined payloads
HTTP response logs
Check it out on GitHub: GitHub Repo
Looking forward to connecting with the cybersecurity community!
#CyberSecurity #XSS #PenTesting #GoLang #Docker #WebSecurity #Mastodon #OpenSource
Learn about XSS for XMAS!
We created a new MDN page about Cross-site scripting: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS
Good article about MITRE ranking XSS as the Top Threat of 2024.
https://scotthelme.co.uk/xss-ranked-1-top-threat-of-2024-by-mitre-and-cisa/
"Encryption at Rest" for JavaScript Projects
Following a previous post (https://infosec.exchange/@xoron/113446067764347249), which can be summarized as: I'm tackling state management with an extra twist: integrating encryption at rest!
I created some updates to the WIP pull-request. The behavior is as follows.
- The user is prompted for a password if one isn't provided programmatically.
- This will allow for developers to create a custom password prompts in their application. The default fallback is to use a JavaScript prompt().
- It also seems possible to enable something like "fingerprint/face encryption" for some devices using the webauthn api. (This works, but the functionality is a bit flaky and needs to be fixed before rolling out.)
- Using AES-GCM with 1000000 iterations of PBKDF2 to derive the key from the password.
- The iterations can be increased in exchange for slower performance. It isn't currently configurable, but it might be in the future.
- The salt and AAD need to be deterministic and so to simplify user input, the salt as AAD are derived as the sha256 hash of the password. (Is this a good idea?)
The latest version of the code can be seen in the PR: https://github.com/positive-intentions/dim/pull/9
I'm keen to get feedback on the approach and the implementation before i merge it into the main branch.
"Encryption at Rest" for JavaScript Projects
I'm developing a JavaScript UI framework for personal projects, and I'm tackling state management with an extra twist: integrating encryption at rest!
Inspired by this React Hook: Async State Management (https://positive-intentions.com/blog/async-state-management), I’m extending it to support encrypted persistent data. Here's how:
The Approach:
Using IndexedDB for storage.
Data is encrypted before saving and decrypted when loading using the Browser Cryptography API.
Event listeners will also be encrypted/decrypted to avoid issues like browser extensions snooping on events.
The password (should never be stored) is entered by the user at runtime to decrypt the data. (Currently hardcoded for now!)
The salt will be stored unencrypted in IndexedDB to generate the key.
Proof of Concept:
You can try it out here: GitHub PR (https://github.com/positive-intentions/dim/pull/8). Clone or run it in Codespaces and let me know what you think!
Looking for Feedback:
Have I missed anything? Are there better ways to make this storage secure?
Let's make secure web UIs a reality together!
What we learned when we tried to deploy a CSP for openwebdocs.org and how we are updating the docs on MDN for Content-Security-Policy:
https://openwebdocs.org/content/posts/self-experimentation-with-csp/
Can anyone explain how the security around @Vivaldi accounts works. I'm loathe to sync across devices without understanding it better. Maybe I am not looking in the right places? #webSecurity
Patchstack is a security company focusing on WordPress.
There's a million and a half sites hosted on WP Engine. Mullenweg has cut them from any security update.
Mullenweg is a risk for the open internet. He's a patent troll with too much power in his hands.
…hier noch ergänzend, wie die vorgegangen sind um @torproject zu "hacken":
«Darknet – Ermittler nutzten Timing-Analyse zur Deanonymisierung von Tor-Nutzern:
Die Ermittlungsakte zum Boystown-Prozess enthält Hinweise auf eine Timing-Analyse, mit der Tor-Nutzer deanonymisiert werden können. Abhilfe ist nicht in Sicht.»
…nun hat @torproject eine Stellungnahme zur der erwähnte Unsicherheit im oben verlinkten Artikel. Auch wenn ich vorhin den Artikel entsprechend kommentierte ist ihrer Blog-Post mMn sehr wohl zu loben.
[ENG]
«Is Tor still safe to use?»
https://blog.torproject.org/tor-is-still-safe/
https://mastodon.social/@torproject/113159994494222570
In "Web Security: shaping the secure Web" W3C CEO @seth explains why and how Web Security as a requirement for humanity is central to W3C’s mission, mentions digital identities and credentials as a high-stake current focus, and invites all to participate. #WebSecurity
https://www.w3.org/blog/2024/web-security-shaping-the-secure-web/