Elar Lang

Pentester, researcher, lecturer

[Elar Lang @elarlang]

@MSportLtd @JoshMcErlean5 @OfficialWRC @MIRallyAcademy @SafetyCultureHQ Virves disagreed.

[Elar Lang @elarlang]

@JoshCGrossman @opengrep @semgrep Soon...

[Elar Lang @elarlang]

@DeathsPirate @dcuthbert @JoshCGrossman Please recheck, do those paragraphs and requirements actually exist...

(The answer is no)

[Elar Lang @elarlang]

@dcuthbert @pr0mille - do you know anything about it?

[Elar Lang @elarlang]

@JoshCGrossman And this is exactly what I ask: why do you need to validate the Content-Type request header?

[Elar Lang @elarlang]

@dcuthbert Seems like Portugal and the reason to gain 1kg per day...

[Elar Lang @elarlang]

@intigriti The point - you can convert your HTML to unicode or hexlist and it will be executed as HTML (because .innerHTML).

[Elar Lang @elarlang]

@intigriti \x3cimg src=x onerror=alert(1)\x3e

[Elar Lang @elarlang]

@paddocknews Last time there was Julien Ingrassia commenting and if I remember correctly, he described that new generation make notes digitally. So I think it is all like expected.

[Elar Lang @elarlang]

@HartusvuoriWRC @Becsywecsy Teemu SISUnen

[Elar Lang @elarlang]

@manicode But seems, that you reach to that parameter yourself as well. The question originally was only about sending. For reading, if you don't have ACAO setup opportunity, then I there is always old-not-so-good JSONP.

[Elar Lang @elarlang]

@manicode So the boolean answer is yes, that's why we have CSRF attacks :) Just need to use XHR param ".withCredentials=true;" and rest of it must be CORS-safelisted (previously known as Simple Request) compatible

[Elar Lang @elarlang]

@oryxspioenkop Put Iceland to the list.

[Elar Lang @elarlang]

@jimkwik Twitter combined it nicely... :)

[Elar Lang @elarlang]

Also I have proposed related requirement on the topic to @OWASP_ASVS (not yet released v5.0, bleeding edge):
V3.4.6 Verify that cookie-based session tokens are only transferred in Set-Cookie and Cookie headers.

... but for Drupal the issue was a bit wider.

[Elar Lang @elarlang]

From July 2022, Drupal has released 9 Security Advisories for CORE, and I have caused 2 of them. Previously SA-CORE-2022-014, and now SA-CORE-2023-004:
https://t.co/8XLmmcV9oo

[Elar Lang @elarlang]

@dcuthbert

[Clarified Security @clarifiedsec]

After years of hearing questions like "Do you have any course that teaches how to make stuff more secure instead of only breaking it?" we finally have a course about configuring services to reduce their attack surface! https://t.co/j6ObCW9FqM

[Elar Lang @elarlang]

@OctagonNetworks Everyone seems to use document.write for writing HTML here. But the problem exists even when we change document.write with console.log. Shortest known payload 21 symbols. Were you aware of this, @OctagonNetworks ?

[Elar Lang @elarlang]

@OctagonNetworks Doable with limited phone browser as well