Viewing profile — MajesticHobo2

Browser sandboxing is now fully solved.

It's the same style I see on Twitter and LinkedIn a lot.

Why does it have to be deliberate? It's not surprising that people exposed to output from LLMs will unconsciously pick up their linguistic habits.

I'd say also add a test that shows the HTML injection (which spurred the PR) isn't possible. Given an attacker-controlled URL of: foo onclick the following shouldn't render: The fo…

It was definitely partially about model quality. The frontier models are capable of producing valid findings with (reasonably) complex exploit chains on the first pass (or with lim…

> With decompilation I think there's a higher risk of it missing the intention of the code. I'm not sure but suspect the lack of comments and documentation might be an advantage to…

That was then, this is now. The new models are scarily good. If you're skeptical, just take an hour to replicate the strategy the article references. Point Claude at any open-sourc…

Third or fourth, maybe, not first.

Yes, but it would likely have to be chained with other bugs - at minimum, something that gives you an info leak.

Yeah, somebody came up with one here: https://news.ycombinator.com/item?id=46469897

It’s a phase 1 clinical trial designed only to assess safety and determine the appropriate dosage. Future trials will focus on efficacy.

Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?

I'm sure they can store far more than 20 TB now, but it is true that the content pool is much larger. I would guess it's not a favorable ratio.

Thanks for making this! I've been looking for something like this for a while.

xxd IMGP0847.DNG | grep 03e400: 0003e400: ffd8 ffc3 000e 0e10 800c 5002 0011 0001 ..........P..... Look at the byte at offset 11 (0xb), it's there.

Yes: dd status=none if=IMGP0847.DNG bs=1 skip=0x3e40b count=1 | xxd 00000000: 02

You need to click the link that says "RAW (33.0MB)". The filename should be "IMGP0847.DNG".

I AirDropped the PoC to my vulnerable iPhone. It didn't cause a crash until I tried to edit it in the Photos app.

That's exactly why I don't agree that GETs should be broadly exempted from CSRF protections. I'm not talking about CORS at all.

The problem boils down to the lack of equivalence between a site and an origin. The article explains how https://app.example.com and https://marketing.example.com may sit at very d…

Not sure I agree with this part: > Allow all GET, HEAD, or OPTIONS requests. > These are safe methods, and are assumed not to change state at various layers of the stack already. P…

XFF handling is the bug that keeps on giving. I'd estimate I've seen incorrect parsing of it in at least half of the web applications I've audited professionally. The funniest is w…

You can use FTP and SVN.

There doesn't need to be any kind of "polyglot payload". Local network services and devices that accept only simple HTTP requests are extremely common. The request will go through …