Content Injection Attack on GitHub

Post by DaiPlusPlus » Sat, Jun 08, 2024, 8:02 AM UTC

mesmertech wrote: post #9

wokwokwok wrote: post #6

You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…

that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"

Post by pandaxtc » Sat, Jun 08, 2024, 8:05 AM UTC

Post by pindab0ter » Sat, Jun 08, 2024, 8:20 AM UTC

mesmertech wrote: post #9

wokwokwok wrote: post #6

You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…

that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"

Post by sshine » Sat, Jun 08, 2024, 9:15 AM UTC

pindab0ter wrote: post #15

mesmertech wrote: post #9

Earlier quoted context omitted.

that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"

What does one's pfp matter, if what they found holds water?

Post by mmsc » Sat, Jun 08, 2024, 9:16 AM UTC

shakna wrote: post #16

mmsc wrote: post #12

Other than I love Samy, are many real-world examples of XSS being exploited for massive takeover of some service? I can't say I remember any news of a "website/service totally taken over due to XSS."

XSS tends to be the first step in a chain of exploits. There are examples of using it for account takeovers, but XSS being the first step, usually means it doesn't get called out directly. The particular chain sequence gets a name, and that is what gets put out in media responses.