chloe

Security Engineer

[chloe @dotchloe]

@terjanq When are you planning to publish the package? Would like to do some testing :)

[chloe @dotchloe]

@Rhynorater @garethheyes Meh, it will take 5 years until you'll actually see this in a product :D

[chloe @dotchloe]

@ycombinator @SellRaze @JeffMao_ @TylerMa_ lol, I built an app for this like a year ago for personal use, even an agent that can answer questions and remove other listing once sold

[chloe @dotchloe]

@TomNomNom Are you coming to Stockholm? :)

[chloe @dotchloe]

@joaxcar iframe also has a "csp" attribute https://t.co/xg7MhKeQPI

[chloe @dotchloe]

@cure53berlin @IcesFont What's the reason you didn't assigned a CVE for this?

[chloe @dotchloe]

@TomNomNom I like that there's XSS

[chloe @dotchloe]

@renniepak 1% man

[chloe @dotchloe]

@garethheyes @YNizry @garethheyes See: https://t.co/M6y7zbfvw5 - needs <script> tag

[chloe @dotchloe]

@troyhunt @capellisport @Scott_Helme @milkyjoseph Try your luck over at https://t.co/f4yFwrpUQU cc @caseyjohnellis

[chloe @dotchloe]

@DrReinhold @bramus @sw12 Of course, the hash is never sent to the server.

[chloe @dotchloe]

@Agarri_FR That's fine as tweets about CVE's are often just reposted content.

[chloe @dotchloe]

@we1x Allowing CDN's, unsafe-inline and self in style-src would still mitigate this attack?

[chloe @dotchloe]

@LiveOverflow Back in 2014 this was more considered a best practice. Today, a requirement. But there's no impact, so no bounty.
Also, would've focused mostly on setting up a RDP than fixing the issue.

[chloe @dotchloe]

@renniepak Vitamin D, light therapy and looking forward to skiing is the key :)

[chloe @dotchloe]

@win3zz Result of sec research could later lead to bug hunting.

[chloe @dotchloe]

@garethheyes wait, it was never named "HackVector"?!? This is the mandela effect in play

[chloe @dotchloe]

@ITSecurityguard Definitely not snakeoil. Just an alternative way of learning.

[chloe @dotchloe]

@roohaa_n @Bugcrowd This is indeed bad. Before a company launch a program, they should CLEAR the backlog! 100$ for a P1 should make you instantly stop hacking on that program.

[chloe @dotchloe]

@7odamoo Can you provide more info? Can you control a href value in an A tag? If so, '\t', '\n' and '\r' are allowed to be after "javascript" and ":" - so "javascript\n:" is valid in Chrome.