Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Easy
Reflected XSS protected by CSP, with CSP bypass
reflected xss where the csp is built from a token we control, bypassed by injecting script-src-elem 'unsafe-inline' into the report-uri so the policy itself whitelists our inline <script> and it runs
Cross-site scripting (XSS) 3 min -
Medium
Reflected XSS protected by very strict CSP, with dangling markup attack
strict csp that kills script xss, bypassed with a dangling markup form hijack, injecting a formaction button with formmethod=get to leak the victim's csrf token to the exploit server, then forging an authorized email change with it
Cross-site scripting (XSS) 6 min -
Medium
Reflected XSS in a JavaScript URL with some characters blocked
reflected xss in a javascript url with parentheses and spaces blocked, solved by calling alert without parentheses
Cross-site scripting (XSS) 4 min -
Easy
Reflected XSS with event handlers and href attributes blocked
reflected xss where every event handler and anchor href is blocked, solved by using an svg <animate> element to set a blocked href to javascript:alert(1)
Cross-site scripting (XSS) 3 min -
Hard
Reflected XSS with AngularJS sandbox escape and CSP
reflected xss that beats both csp and the angularjs sandbox by injecting an ng-focus directive
Cross-site scripting (XSS) 5 min -
Hard
Reflected XSS with AngularJS sandbox escape without strings
reflected xss through an angularjs sandbox escape with $eval removed and string literals banned, solved by overwriting charAt to disable the sandbox and running a fromCharCode built x=alert(1) through the orderBy filter
Cross-site scripting (XSS) 6 min -
Easy
Exploiting XSS to bypass CSRF defenses
stored xss used to defeat csrf token by running js in the victim's own session that reads their token off the account page and send authenticated request to change their email
Cross-site scripting (XSS) 3 min