@insertscript@infosec.exchange # https://xitter.cf/t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53

Joined June 2012
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
When you like DNS related shenanigans, this is fun to check for yourself.
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC blog.alice.poc.debiru.net/ 1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。 (参考) 検証用URL blog.alice.poc.debiru.net/ FAKEサーバー debiru.static.jp/ TRUEサーバー blog.bob.poc.debiru.net/
5
1,347
alex retweeted
On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
353
1,388
548
11,820
2,821,102
Replying to @rebane2001
uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.
1
570
We are going to be at DEF CON! If you want to learn fault injection hands-on, make sure to bring your laptop.
3
32
2
354
21,487
Replying to @J0R1AN
this is perfect - I needed that for a test case I always wanted to try^^
2
713
alex retweeted
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declarative-…
5
27
1
134
16,358
If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post: blog.voorivex.team/content-t…
Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.io/challenges/mimic-2
6
41
2
226
21,659
Replying to @garethheyes
oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^ +{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}
9
394
alex retweeted
I co-authored an educational article on cache poisoning vulnerabilities with @intigriti. If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!
Most hunters skip web cache poisoning because it looks intimidating... 😓 But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠 In our latest article, we walk you through identifying cache layers, spotting unkeyed inputs, and chaining them into real impact! 😎 This time, we teamed up with Zhero (@zhero___) who is well-known for his research around cache poisoning vulnerabilities! 💪 Read the article now!👇 intigriti.com/researchers/bl…
7
32
1
253
16,043
DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。 特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた github.com/cure53/DOMPurify/…
1
41
2
179
13,948
alex retweeted
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____): Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js zhero-web-sec.github.io/rese…
6
66
3
357
23,794
Replying to @magicmac2000
I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D
1
1
287
alex retweeted
FFFF the axios thing is bad, almost all node.js project use it, we use it. didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway. CHECK YOUR IMAGES. github.com/hacktronai/cull
4
11
1
78
15,227
Replying to @AmirMSafari
Well I learned a lot trying to solve this challenge. But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)
3
361
Replying to @shhnjk
Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image
1
3
274
Again just a quick JS PoC (nothing new, just some PoC to try it): JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused. insert-script.com/examples/j…
1
9
896
Your chance to be part of a historic event for cryptography education in the Levant is still open! The CFP for Cedarcrypt, the most ambitious and exciting cryptography event in the Levant region in recent memory, has a deadline of April 10 and we still have room in the program. If you've been meaning to submit a talk, workshop, or research presentation, now's the time. We want hands-on workshops, lectures on both foundational and real-world topics, and research talks including work in progress. Topics range from post-quantum crypto and ZK proofs to secure implementation and protocol verification. We're also still actively seeking sponsors. Sponsorship funds student stipends directly — it's how we make the event accessible to grad students and early-career researchers worldwide. If your organization is in this space, let's talk. Accepted speakers get travel support, free registration, and accommodation help. July 13–16, Paphos, Cyprus. Join us in making a real difference in how real-world cryptography is taught in the Levant! Come meet and engage with excited new students! cedarcrypt.org
5
15
2,302
Replying to @rebane2001
The only solutions I can think of: Overwrite the prototypes - Number or Object use document.all as the one exception. Afaik no symbols are utilized sadly for this operator.
128