Pages tagged vulnerability:

PJF's Pages - Journal - Dark Stalking on Facebook
http://pjf.id.au/blog/?position=590

What makes this all rather chilling is that I'm doing all of this via the application API. If your friend has installed an application, then it can access quite a lot of information about you, unless you turn it off. If your friend has granted the application the read_stream privilege, then it can read your status stream. Even if a friend of a friend has done this, and you comment on your friend's status entries, it's possible to infer your existence and retrieve those discussions through dark stalking.
Most recently, I've been able to obtain status feeds, even for users who have very tight privacy settings, although I had to tweak my own application's privileges to do so. I don't know how far into the past these go, but they also come with likes information, and comments. This gives me a wealth of information on the strength and types of relationships people have. A person who comments a lot on another user's posts probably finds that user interesting. If I descended into keyword and text analysis, I may even be able to determine how they find that user interesting.
Programs to pull info out of facebook accounts
the information available to people via facebook is amazing....
Penetration Testing and Vulnerability Analysis - Home
http://pentest.cryptocity.net/
Penetration Testing and Vulnerability Analysis
Innovative course at NYU-Poly that discusses Penetration Testing and Vulnerability Analysis . The course is split into six 2 week modules where an industry expert comes in and teachers a portion of the course. The website has all the course materials and even some of the lectures in video format.
Hueniverse: Explaining the OAuth Session Fixation Attack
http://www.hueniverse.com/hueniverse/2009/04/explaining-the-oauth-session-fixation-attack.html
Anatomy of a Subtle JSON Vulnerability
http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx
Resources that emit Json arrays risk data theft