Ivan Fratric's Security Blog

In an earlier post, I talked about a technique called Cross-domain Math.random() prediction . And while the technique is interesting it is ...

In my previous (brief) post  I was very excited to announce that ROPGuard, a system for runtime prevention of return-oriented programming a...

Earlier this year, I participated in Microsoft's BlueHat Prize contest - a contest to design a novel runtime mitigation technology des...

I was recently introduced to an interested project called Google Caja . Google Caja is basically a compiler/sandbox that makes user-supplie...

I recently descovered an interesting security issue in a web application that could be potentially exploited if an attacker could guess the...

A while ago I realized that it's been a long time since I wrote about the web application security here, so when Facebook announced thei...

Those of you that follow my blog know that I am not accustomed to publishing the exploit code for critical vulnerabilities. I'm only pub...