zosec

hacker of boxes, ctf player, security engineer, cook, soccer player, gamer, she/her

[YesWeHack ⠵ @yeswehack]

A new open-source tool from @BitK_ reveals how popular browsers parse HTML – simplifying the hunt for mutation XSS and opening up new horizons in security research 🔬 Read about this valuable addition to your 'Hacker's Toolbox' in our latest blog post 👇
https://t.co/rQyRdhseP5

[Sonar Research @Sonar_Research]

🔥 XSS on any website with missing charset information? 😳

Attackers may leverage the ISO-2022-JP character encoding to inject arbitrary JavaScript code into a website. Read more in our latest blog post:

https://t.co/Ji3V0fK5b6

#appsec #security #vulnerability

[Google VRP (Google Bug Hunters) @GoogleVRP]

🚫 DOM XSS, begone! 👋 Discover how we used Trusted Types to protect AppSheet, and how that can inform your own web application's journey to a safer security posture where DOM XSS vulnerabilities are a thing of the past.

https://t.co/JPnfTO0pK3

[PortSwigger Research @PortSwiggerRes]

May take quite a few years before it's actually rare. It'll be interesting to see if this boosts research into other SSRF pivot strategies and chains like https://t.co/Dv8Kc8zhH8

[PortSwigger Research @PortSwiggerRes]

Excellent work by @mbsdnews' Takeshi Terada exploring multibyte attacks on URL parsing
https://t.co/vIUZx8NtlY

[Rolix @Rolix_cy]

Hello there ! I’m really proud to announce that my first tool is now out 🔥

Kubestroyer is a golang tool that take advantage of #Kubernetes clusters misconfigurations to break into it and automate your penetration tests.

You can download it here :
https://t.co/nSaa3jhW4a

[Web Security Academy @WebSecAcademy]

We've just launched a new topic on bypassing SameSite cookie restrictions! Learn how to evade browsers' cookie defences and perform successful cross-site attacks with our interactive labs:
https://t.co/CCT9UamLwz

[huli @aszx87410]

In the last Intigriti XSS chall, there is a part about finding the prototype.js replacement on cdnjs to bypass the CSP.
I made a simple script to fetch all the libraries and use headless browser to find who pollute the prototype, here is the blog post

https://t.co/DmZxfy3eDM

[Vidoc Security Lab @vidocsecurity]

Vulnerability that made us 30 000$ richer (and we still submit reports) - XSS in Swagger-UI related to a bug in DOMPurify - many people waited for this writeup so here you are. Article by @kannthu1 - happy hacking! https://t.co/dVxqCxhWDS

[Renwa @RenwaX23]

New writing about the story of 3 bug bounty reports in which I chain low severity bugs together for higher impact and less known browser tricks.

Includes CSS injection, Self-XSS, Drag-Drop XSS, Cookie Bomb, Login-Logout-CSRF, and more...

https://t.co/vPpnuKPU8g

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2021!

https://t.co/t3pMqnLt2T

[Sachin Thakuri @sachinnthakuri]

A blog by me & @1lastBr3ath discussing our findings we presented in Black Hat Europe #BHEU talk titled “Exploiting CSP in Webkit to break Authentication/Authorization”. Find out how we made more than $100k in bug bounties with a bug ignored by Apple. https://t.co/vN2b5v7k5s

[James Kettle @albinowax]

Just watched "Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond" - must-read research by @intruder_io's Daniel Thatcher
https://t.co/KJTnPwGOAe

[zosec @zoeysec]

I did a thing

[GRIMM Cyber @grimmcyber]

ICYMI: Our Private Vulnerability Disclosure team just released an amazing ROOT EXPLOIT FOR NAGIOS systems!

Hit us up to get notified in advance of our non-public vulns, or to have your software/environment tested!

https://t.co/rK7K5NLbte
https://t.co/rK7K5NLbte

[s1r1us @S1r1u5_]

Finally, here is the blog for the prototype pollution research we did.

"A tale of making internet pollution free"
- Exploiting Client-Side Prototype Pollution in the wild

https://t.co/jsShZGlgKB

[Sam Curry @samwcyo]

Client side path traversal is a really fun thing to explore for CSRF and XSS. Revisited an unexploitable blind SSRF which (1) required the authorization header to be sent and (2) passed the authorization header to the provided "url" parameter. This would be account takeover ...

[Aleksei Tiurin @antyurin]

I also updated the cheat sheet and uploaded docker images in https://t.co/WaSSP7DZrO

[Paulos Yibelo @PaulosYibelo]

PHP drops any header if it finds nullbyte value in the header. If user controls input in header, they can chose to drop the header. This works on PHP since 2015 but will be fixed on next version. #BugBounty

Solution for my CTF:
%00<img src=x onerror=alert(1337)>

[publiclyDisclosed @disclosedh1]

GitLab disclosed a bug submitted by @bananabr: https://t.co/MFSmZriRn1 - Bounty: $500 #hackerone #bugbounty

[Luan Herrera @lbherrera_]

This year, for Pwn2Win 2021 CTF, I relaunched MessageKeeper. The main idea was to exploit Chrome's AppCache fallback section (and the fact that it matches URLs by prefix) - I think it was the hardest challenge I created to date! A solution can be found on https://t.co/F77yzFBe2g