401–410 of 453 posts
Earlier quoted context omitted.
Wow did not realize a url could be set like that without promoting a page reload...
To be clear only the path and query parameters part of the url can change, the domain (or sub domain) stays intact.
38 days after @hackermondev's disclosure, our automated OSINT harvester pulled 121 IOCs from OpenPhish/OTX:
- 101 URLs for discord.flawing.top/blog/* (mimicking Discord's documentation structure)
- 20 URLs for openopenbox301.vercel.app (phishing hosted ON Vercel)
The attackers read the same disclosures we do. They just build infrastructure instead of writing reports.
Evidence (queryable):
curl "https://analytics.dugganusa.com/api/v1/search?q=discord.flawing.top"
Full writeup with IOCs: https://www.dugganusa.com/post/mintlify-xss-downstream-exploitation-captured
STIX feed (free): https://analytics.dugganusa.com/api/v1/stix-feedHow these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.
no, he needs to make his own agency
Earlier quoted context omitted.
How is XSS not remote code execution? You can do anything, from send fetch requests to the server with full credentials to loggging keystrokes or even open a tunnel and eval payloads... Anything the user can do, you can do via an XSS attack.
Generally code execution within browser/client-side javascript sandbox is just "XSS". RCE usually implies server-side code execution (or breaking out of browser sandbox).
Earlier quoted context omitted.
If only there was a widely used vector format that had script support and also decades of work on maintaining a battle-tested security layer around it with regular updates on a faster release cycle than your browser. That'd be crazy. Sure would suck if we killed it because we didn't want to bother maintaining it anymore. (Yes I'm still salty about Flash.)
SVG without would do just fine.
Earlier quoted context omitted.
>Also not much excuse for xss these days. XSS is not dead, and the web platforms mitigations (setHTML, Trusted Types) are not a panacea. CSP helps but is often configured poorly. So, this kind of widespread XSS in a vulnerable third party component is indeed concerning. For another example, there have been two reflected XSS vulns found in Anubis this year, putting any website that deploys it and doesn't patch at risk…
Is it really fair to compare an open source project that desperately wants only $60k a year to hire a dev with companies that have collectively raised over billions of dollars in funding?
Earlier quoted context omitted.
I do occasionally wonder how different things would be if JavaScript had come with a very robust standard library from early on.
I also wonder about it recently. Also in regards to Rust which is hailed as the great savior but has the same, minimal, approach to standard library and needs loads of dependencies.
Rust doesn't have a very broad stdlib, but it has an extremely deep stdlib. Rust's stdlib is huge for the things it provides. Classical JS's stdlib was neither deep nor broad.
Furthermore, tons of those "loads of dependencies" that people point to are crates provided by the Rust project itself. Crates like serde, regex, etc aren't third-party dependencies, they're first-party dependencies just like the stdlib.
This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com
Earlier quoted context omitted.
Postscript is pretty neat IMHO and it’s Turing complete. I really appreciated my raytraced page finally coming out of that poor HP laser after an hour or so.
PostScript can emulate the ZMachine (Zork text adventures and all of infocom) with "zmachine.ps". Look it up at DDG/GG.