Bread

Skeptic, Rationalist, Computer Scientist, Cyber Security Professional.

[Bread @nonsxd]

@NicolasHeiniger @SpecterOps @matterpreter Nice I was looking at their courses, just need to justify it, haha.
But it looks like actually useful content.

[Bread @nonsxd]

@DoctorKarl @Cosmic_Horizons @cosmicpinot Or.
Both are moving on the x and y.
Then a z multipler is applied to the bucket.
Now the fruit still on the same path
Bucket is not as it has a z multipler.

[Bread @nonsxd]

@DoctorKarl @Cosmic_Horizons @cosmicpinot It's just timing.
He is moving both objects (bucket, red fruit), from the ground, up.
At some point(end of his reach), he applies a force to the bucket.
The fruit continues on original trajectory, bucket takes a new path.
In the end, its just a little flick for this trick.

[Bread @nonsxd]

@hakluke Hack the planet

[Bread @nonsxd]

@LiveOverflow ok so this is a dead thread now, but I finally found what you used this for and can see the discrepancy between what I thought and what you asked.

I skipped the keyword "pure" as in, an open redirect by itself. had I paid more attention I would have agreed out of the box.

[Bread @nonsxd]

@varcharr Easy.
<esc>
<shift> + :
!bash

[Bread @nonsxd]

@gynvael Ouch don't you hate it when you die on a hill from a single pixel change!

[Bread @nonsxd]

Thats awesome!

[dragosr @dragosr]

Derived “Master Faces” that unlock face based auth. A synthesized set of nine has 40-60% success. TL;dr Face auth extremely vulnerable. https://t.co/Ync6F8bckB

[Bread @nonsxd]

@LiveOverflow @LivEdOverflow I respectfully disagree, I appreciate the replies and your time, thanks.

[Bread @nonsxd]

@LiveOverflow @LivEdOverflow except for anything at your disposal within the rendering process space.

[Bread @nonsxd]

@LiveOverflow @LivEdOverflow but a bufferoverflow is just a misused or misconfigured buffer, with unintended data.
how does that differ from ?redirect=<something unintended>

[Bread @nonsxd]

@LivEdOverflow @LiveOverflow alternatively you could think of ?redirect= as EIP (albeit verrrrrry broadly).

if i control EIP then i control the flow, what happens next is up to your imagination.

[Bread @nonsxd]

@LivEdOverflow @LiveOverflow you could also think of an open redirect like an ANY ANY firewall rule.

unless you intended that, its a misconfiguration and people can take advantage of that for their own gain.

[Bread @nonsxd]

@LiveOverflow additionally I could see an attacker utilising an open redirect to get browser fingerprint prints, ad revenue, fine-tune a phishing campaign.
all due to the redirection appearing to have more trust associated with it than maybe a standard link.

[Bread @nonsxd]

@LiveOverflow and probably the best use case.
stealing OAuth using open redirects.
https://t.co/1UZekGnSCU

[Bread @nonsxd]

@LiveOverflow my guess is an open redirect could also be used to bypass same-origin policies.
would you consider that a form of exploitation if the open redirect facilities the end goal?

[Bread @nonsxd]

@LiveOverflow I don't know if this is still a a thing, but say an attacker already has MiTM capabilities, but cant inject because its all HTTPS traffic.
they can use an open redirect to downgrade a HTTPS to HTTP, giving them the ability to then proceed with other MiTM attacks (maybe).

[Bread @nonsxd]

@LiveOverflow say for whatever reason a website will accepts links to custom JS code and runs it from a website it trusts.
The only mitigation is it checks the domain of the link.
An open redirect in the trusted site gives you a means to bypass the check and run code.