I've published my new research, "Exploiting Number Parsers in JavaScript". In this article, I’ve discussed the number parsers in JavaScript and the different attack scenarios you might encounter.
https://t.co/VMVqHF3j2q
@GoogleVRP disclosed my most impactful client-side report to date:
https://t.co/yGZJrSZEbe
TL;DR An attacker could've gained access to Gemini Code Assist Tools (GitLab, GitHub etc.) configured by the victim
"AI Agents for Offsec with Zero False Positives" by @moyix, a journey on how we managed to get 0 FPs with XBOW. You can find the slides for his BH talk here: https://t.co/vFEfm5HkxT
❌ Eliminating almost all exploitable web vulnerabilities? This blog post covers how the Google security team implemented a high-assurance web framework to achieve this goal for its services, and what this framework's most important characteristics are.
https://t.co/dohOwvCOtz
Write-up of my v8 bug: Critical type confusion in V8's Turboshaft compiler allowed stale pointers to bypass GC, leading to exploitable memory corruption.
Full details + PoC: https://t.co/wxgl5BQQVK
It's an honor that my research, Exploiting Number Parsers in JS, has been nominated for the Top Ten Web Hacking Techniques of 2024. I discussed how discrepancies in JS number parsers could be used to carry out DoS attacks. If you find it interesting, please vote for it!
🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace.
When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete.
#mXSS#XSS
Just discovered 10 memory corruption vulnerabilities in the popular Mongoose Web Server (11k stars on GitHub) by fuzzing its embedded TLS stack protocol with @aflplusplus. More technical details here: https://t.co/AzK6USwACO
Released a new extension :)
- https://t.co/sphNJdvUyt for postMessages from all_frames.
- detects the scope of sent messages.
- origins that are insecure, will be prefixed with UNSAFE.
- detects if a website does not check .origin
- MessageChannel API
https://t.co/56gtuIU7qw
I'm thrilled to finally share my research on HTML parsing and DOMPurify at @GreHack 2024 📜
The research article is available here: https://t.co/GIqy0hTCdR
The slides are available here: https://t.co/97iiZgoJqb
1/3
I created a small tool to automatically set breakpoints in Chrome using the CDP (Chrome DevTools Protocol). It’s still in beta, but I’m actively working on a complete version.. https://t.co/8Hn5XgAWs1
I've published my new research, "Exploiting Number Parsers in JavaScript". In this article, I’ve discussed the number parsers in JavaScript and the different attack scenarios you might encounter.
https://t.co/VMVqHF3j2q
Here's a code snippet that as far as I can tell pretty much solves prototype pollution. It's based on https://t.co/VkshO7Wpyh, and after running it you can access an object's prototype with object[Symbol.instanceProto], and object["__proto__"] will be undefined.
@MiniMjStar بستگی داره دنبال چی باشی. برای api key اگه دنبالشی میتونی رجکس بنویسی دقیق تر باشه نتیجت. اگه یسری فیلد رو میخوای که صرفا یجای ریسپانس باشه میتونی از contain استفاده کنی. خودم از AutoRepeater استفاده میکنم
I have updated the list of custom filters for Logger++. The new additions include:
. New API Style (gRPC-Web)
. Improved previous filters
. Exposed API keys custom filters
. New filters for API vulnerabilities
https://t.co/XfoRQjvHmu
@MiniMjStar تمام آسیب پذیری های api رو قطعا کاور نمیکنه و یه حالت کلیه. میشه کاستومش کرد به ازای هر تارگت که نتیجه بهتری بده. یسری آسیب پذیری ها هم که ممکنه وجود داشته باشه و توی لاگ نشونت میده، نیاز به تست داره که مطمئن بشی واقعا هست یا نه