Sven Morgenroth

Needs stuff to hack, caffeine, oxygen and tea to survive. In that particular order. Security Research @netsparker

[Sven Morgenroth @asdizzle_]

Using blacklist filters. #justbypassthings

[mongo @mongobug]

@GossiTheDog @threatspikeadam The public exploits use the vulnerabilities to execute external commands but that is not a requirement...

[Sven Morgenroth @asdizzle_]

This should not happen I assume

[Sven Morgenroth @asdizzle_]

pwning with @mongobug :p
https://t.co/59toKEGOrP

[Sven Morgenroth @asdizzle_]

@sasi2103 @mongobug @ITSecurityguard That guy must be like the best hacker in the world or something

[Sven Morgenroth @asdizzle_]

@magnusstubman https://t.co/Y1r5hPLhyZ

[Sven Morgenroth @asdizzle_]

@garethheyes No idea why. SVG is just the weirdest of all tags

[Sven Morgenroth @asdizzle_]

@garethheyes Strange thing with <svg><script> is that it confuses the XSS Auditor. It's fine in the source code (no red), but is blocked nonetheless.

[mongo @mongobug]

A rare case of a bug found through a private bug bounty program being publicly acknowledged. Great to see :) https://t.co/WU9N2nukk4

[Sven Morgenroth @asdizzle_]

@garethheyes Classic one :) You can also use <!> and <?> btw

[Sven Morgenroth @asdizzle_]

@insp3ctre @MarcS0h The chat box in the preview picture perfectly sums up how I'd use it

[Sven Morgenroth @asdizzle_]

Doesn't work in chrome or FF

[Sven Morgenroth @asdizzle_]

How to alert in edge / IE without alert, prompt or confirm using onbeforeunload
https://t.co/BqpGQL6h5o

[Sven Morgenroth @asdizzle_]

No PHP, no spaces, no $, no { }, bash only

IFS=,;`cat<<<uname,-a`

[Masato Kinugawa @kinugawamasato]

All domains using CloudFlare have a CSP bypass gadget. Don't use 'unsafe-eval' for CloudFlare domains.
PoC: https://t.co/9HRSQwOlbO

[Sven Morgenroth @asdizzle_]

@ret2libc @insecurity Sure thing

[Sven Morgenroth @asdizzle_]

Btw, the PHP closing tag can be omitted if you replace it with a semicolon
`cat<<<'<?="uname\x20-a";'|php`

[Sven Morgenroth @asdizzle_]

Command injection without space, $, {, }
Python3 or PHP on server?

uname`cat<<<'<?="\x20"?>'|php`-a
uname`cat<<<'print("\x20")'|python3`-a

[Sven Morgenroth @asdizzle_]

Why testing with XSS polyglots alone sucks

[Sven Morgenroth @asdizzle_]

@Qab That looks cool, didn't test it yet. Maybe Phantom or Selenium have a way to detect it?

[Sven Morgenroth @asdizzle_]

@IngoPan People who try to bypass it obviously?