13618 items (0 unread) in 75 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
.:Computer Defense:.
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
Fortify blog
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
IBM Internet Security Systems Frequency X Blog
extern blog SensePost;
Zero in a bit
Yes a XSS post again. I’m sorry 
I’ve been having fun testing some really good filters (some of the best in the business IMO). I found a vector that isn’t on rsnake’s cheat sheet. Check it out:-
Only works on IE
<isindex type=image src=1 onerror=alert(1)>
Because IE treats the isindex element (a very old html element) as a input tag you can specify the same attributes and execute javascript.
Update…Found another variation which is pretty cool:-
<isindex action=javascript:alert(1) type=image>
