Insecure Message Listener -> DOM XSS -> Authorized access to API routes via CORS
An attacker can extract users' critical information and modify it.
An attacker can also make withdrawal requests on behalf of users.
Their response? #bugbounty
+++
They continued to claim that this is neither critical nor even a real vulnerability, but merely social engineering.
So I am disclosing it with their permission.
The vulnerability is still there, but according to them, it does not pose any real problem at all.
"Based on our data, the team has not considered this vulnerability critical."
You might ask why. I asked the same thing.
Their reply was:
"The vulnerability in question is a form of phishing."
Here is my writeup of Intigriti's December XSS challenge. It consisted of 6 smaller challenges combining into a big 1-click exploit.
One of the most fun ones I've ever played. Loved the unique format by @RenwaX23!
https://t.co/mNYyMzdq0G
third party account linking - account takeover
TL;DR: The developers didn't use OAuth's state parameter or implement their own CSRF protection, which led to my OAuth account being linked to theirs.
https://t.co/5iQLR3hMbr
@sametsahinnet Great extension, I appreciate your work. However, it couldn't find the 'API_KEY' variable on the web page due to the carriage return characters in your watchlist.txt. It works fine when you remove them.
Modified my JSLinkfinderv2 Burp suite extension which is clone of the original InitRoot's BurpJSLinkFinder and now it's available for community edition.
https://t.co/C4WujDmxt2
@Hacker0x01@jobertabma@martenmickos As I know each year #hackforgood destination changes, first it was for COVID-19 then for supporting Ukraine.
As you know one of biggest earthquakes recently happened in Türkiye, per this tweet more than 17K lost their lives.