Fun parser differential to fallback SVG sanitizer bypass:
github.com/freescout-he...
i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values!
check it out if you're into ctfs or wanna challenge your javascript skills
lyra.horse/fun/jscrossw... <3
Thanks @cryptocat.me for inviting me to my first ever podcast!
Check out the section at 29:36 😄
Happy to have made some web chllaenges for Plfanzen CTF. The evetn runs next weekend, cehck it out!
plfanzen.lol
(2/2) After some wild ideas of leaking it, I found a different solution using the obscure "Variables" (curl.se/docs/manpage...) feature of curl. We can define and expand {{USERPROFILE}}, then finish with an 8.3 Shortname "StartM~1" to avoid issues with a space!
The final payload:
New blog post is out! A few vulnerabilities in Mailcow.
A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab. Check it out:
www.aikido.dev/blog/xss-vul...
Now that everybody's had a chance to solve it, here's a timelapse of my playtesting run of the JavaScript Crossword!
SPOILER WARNING: Please try it yourself first in the post below, it's very satisfying to solve, I don't want you to miss out on that 😄
(1 second = 2 minutes)
We tested another mail client, Roundcube this time. The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing.
Scary for password reset tokens...
Blog post below:
www.aikido.dev/blog/roundcu...
I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer!
The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below:
jorianwoltjer.com/blog/p/stori...
(and thanks @garethheyes.co.uk for making Shazzer!)
Cool exploit with @0x999.net:
He found that \x7F breaks Chrome's "Copy as cURL (cmd)" command parsing in Windows Console Host. In combination with a ", it allowed you to add any arguments to curl.
With -o writing files is easy, but we need the username for the startup path... (1/2)
Video
Jorian
Jorian
Jorian
Jorian
Jorian
Jorian
Jorian
How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox malici...
i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values!
check it out if you're into ctfs or wanna challenge your javascript skills
lyra.horse/fun/jscrossw... <3
Rebane
Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...
