MRD7

Security enthusiast ❤️ | OSCP student |

[MRD7 @_mrd7_]

Bug bounty has changed my life. Thank you to the bug bounty platforms and all the programs.
@Hacker0x01 @Bugcrowd

Before After

[MRD7 @_mrd7_]

@Youssef12142311 When was the original report submitted?

[MRD7 @_mrd7_]

I feel sad for this guy who own this report #3731792 on #hackerone

[MRD7 @_mrd7_]

@Masonhck3571 Who is forwarding you Indian memes? 😂

[MRD7 @_mrd7_]

@Masonhck3571 1. What difference have you noticed from Triager POV?
2.Are you guys receiving more reports than usual? And how many are valid?

[MRD7 @_mrd7_]

@rez0__ @hacker_ It all comes down to this question: "How much did you spend in tokens?"

[MRD7 @_mrd7_]

@hetmehtaa Bro, after reading the first line and looking at the pic, I was like, "Wait, is that the culprit?!" 😅.

[MRD7 @_mrd7_]

@sudhanshur705 Nice work. 🙌

[MRD7 @_mrd7_]

Good DOM resource.

[3NVZ | Robert S. @YourFinalSin]

Was looking into DOM XSS today and found this resource. It contains research and articles on advanced XSS cases, including the payloads♟️

https://t.co/6gMrgJl4Oy

[MRD7 @_mrd7_]

@sudhanshur705 Thank you for the detailed explanation. I should have been clearer with my question. I was wondering whether this could be exploited over a network. But I suppose the answer is no, since there is no parameter that would allow setting the sessionStorage value "badValue" remotely.

[MRD7 @_mrd7_]

DOM XSS attention please:‼️

Can this be exploited in real without open redirect?

Working payload in console:
sessionStorage.setItem('badValue', 'alert(document.domain)');

Link: https://t.co/57YmfkOd56

[MRD7 @_mrd7_]

@MouhannadlrX0 Link is already shared above. Open the link and check the source code.

[MRD7 @_mrd7_]

@MouhannadlrX0 Yeah. Actually Google had placed this challenge under DOM (toxicdom) category, so I had written like that. Do you know how it can be exploited?

[MRD7 @_mrd7_]

@sudhanshur705 @TeslaTheGod @S1r1u5_ @0xGodson_ I had no idea @0xGodson_ is Indian! And I was already surprised when @PwnFunction revealed his identity!

[MRD7 @_mrd7_]

Hi @TeslaTheGod, I was watching your video on YT [https://t.co/2kiuVb2TQD].

You were talking about Indian client-side folks, then @sudhanshur705 is one of the best out there.

[MRD7 @_mrd7_]

@dropn0w @Hacker0x01 Congratulation. And all the best 👍

[MRD7 @_mrd7_]

5/n
https://t.co/skTPEvslrr

[MRD7 @_mrd7_]

Learning CSP? Here are few good resources, if you have some good article links or tips please add below.

https://t.co/HEPv5jJqWU

1/n

[MRD7 @_mrd7_]

script-src 'self' https://t.co/9PMju93Clt; Allows scripts from your domain https://t.co/9PMju93Clt