I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥
The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇
https://t.co/SgsSyxoEMR
1/4
@NahamSec@neophyte2k@Google I'll make sure we send the rationale today. We should have done it inline with the decision, I don't have any excuse why we didn't. It commonly happens that the VRP reward is smaller than expected or 0, but of course we need to explain why this is the case.
We're sending a HUGE thank you to our incredible community of bughunters ! 🙏 Your passion for finding vulnerabilities keeps our users safe 🔒 To show our appreciation, we awarded over $380,000 in bounties this week, including the largest reward ever given in Google VRP history!
Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspiration? Check the video below in which @kkotowicz and @SecurityMB talk about Google VRPs!
https://t.co/RrVGOHM1TE
Pretty cool exploit chain with the redirects. The writeup is also excellent, and the "screenshots" being actually interactive? 🤯
Thanks a lot for the research, @rebane2001!
Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
https://t.co/mxhH2N7teW
If anyone is following the NEWAG vs Dragon Sector case, this article (in PL, but, well, 2024, google translate) is a really good read about the actual lawsuit and the first day of trial.
Second day of trial will be on Jan 15, so there's some time for sides to file more stuff.
🚨💰 Google VRP Reward Update 💰🚨 Good news, we are significantly increasing the reward amounts offered by the Google VRP! Look out for up to 5x higher payouts and a maximum reward of $151,515! Details here:
https://t.co/gYRql7IRST
It's finally happened! NEWAG IP Management just sued us for copyright infringement and unfair competition.
Here's a symbolic picture of the lawsuit as a whole: Newag quoting q3k's own code as supposedly their IP :)
More: https://t.co/8rS20yv06O
So NEWAG (context: https://t.co/PV0gaKc4nx) finally filed a lawsuit against members of @DragonSectorCTF / SPS. It took them a few months from when they said they'll do it, and apparently there were some snafus with addresses, but here we are.
1/n🧵
Ever wondered how to increase your bug bounties 💸 ? Our latest blog post introduces our domain tiers security concept and how it is applied at Google, and includes a list of Google's highest sensitivity domains.
https://t.co/6zy8qCYK42
See how Google's security engineering team handles rollouts at scale, so we can safely enforce Strict CSP, Trusted Types and other security features on 100s new services yearly.
https://t.co/pMcX7UZRAg
A few deprecations shipped in Chrome 120.
Data URLs in SVG <use> is now blocked.
https://t.co/IuGEdL6C5A
CSP Embedded Enforcement's implicit opt-in for same-origin iframes is gone.
https://t.co/1kp0q62pmx