Tessera
Folgen

0x999

@0x999.net

13 Posts910 Follower141 Folgt
Kévin Gervot (Mizu)@mizu.re · last yr.

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

Bild
0x999@0x999.net · last yr.

New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking...

Leaking IPs in Brave Tor Window & Chrome VPNs + Popunders + CSP Bypass

This writeup details multiple IP leak vulnerabilities I discovered affecting Brave's Tor window and Chrome VPN extensions that allowed a malicious actor to leak the real IP address of any visitor to a...

0x999.net

Jorian@jorianwoltjer.com · last yr.

This month, @0x999.net made an awesome and difficult Intigriti XSS challenge. I really enjoyed the openness of this challenge resulting in an unintended solution and the first solve 🩸! Check out how I got there in my writeup below: jorianwoltjer.com/blog/p/hacki...

Intigriti March XSS Challenge (0325) | Jorian Woltjer

A hard Cross-Site Scripting challenge chaining small bugs with one very hard step to leak a fragment directive using Self XSS

jorianwoltjer.com

Kévin Gervot (Mizu)@mizu.re · last yr.

I'm very happy to finally share the second part of my DOMPurify security research 🔥 This article mostly focuses on DOMPurify misconfigurations, especially hooks, that downgrade the sanitizer's protection (even in the latest version)! Link 👇 mizu.re/post/explori... 1/2

terjanq@terjanq.me · 2y ago

Got sniped into the challenge and ended up doing some cool XSS research :D 11 char XSS with mind-boggling race-conditions. TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char) It's shorter than location=name !! terjanq.me/solutions/jo...

11 char XSS (slow race-condition)

terjanq.me

Johan Carlsson@joaxcar.bsky.social · 2y ago

A small code-golf web challenge (free research from you, for me), how short can you make a "fetch content and execute it inline". There is a CSP in a meta tag. Goal: get the content from the file hack.js and have it inserted in the page. like in the image joaxcar.com/xss/self.html

Jorian@jorianwoltjer.com · 2y ago

To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all. If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this! jorianwoltjer.com/blog/p/hacki...

Post: Mutation XSS: Explained, CVE and Challenge | Jorian Woltjer

Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online

jorianwoltjer.com

Johan Carlsson@joaxcar.bsky.social · 2y ago

Here is the "writeup". Hope its clear enough, otherwise ask in comments. Note that there are two paths that will result in XSS. And that the "error path" can be reached in numerous different ways, like alternative 1 and 4. Alternative 5 hits the "successful path" and can also be used in many ways

Bild
Johan Carlsson@joaxcar.bsky.social · 2y ago

Specification challenge! ☃️ Which (if any) of the href values (1-5) would pop an alert in this scenario? 🛑 No testing, just thinking! ⚠️ Warning: answers in comments (bonus: why/why not)

let wrapper = document.createElement("div") document.body.append(wrapper) let anchor = document.createElement("a") /*1*/ anchor.href = "//<style onload=alert()>" /*2*/ anchor.href = "<style onload=alert()>" /*3*/ anchor.href = "https://a.a/<style onload=alert()>" /*4*/ anchor.href = "https://a.1/<style onload=alert()>" /*5*/ anchor.href = "a:<style onload=alert()>" wrapper.innerHTML = anchor.href