Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Easy
Exploiting cross site scripting to capture passwords
stored xss in blog comments abused to steal saved credentials by planting a fake login form
Cross-site scripting (XSS) 4 min -
Easy
Exploiting cross-site scripting to steal cookies
stored xss in blog comments turned into full account takeover by injecting a fetch payload that posts the victim's session cookie to our listening server
Cross-site scripting (XSS) 4 min -
Easy
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode escaped
Reflected XSS inside a JavaScript template literal where every delimiter and tag character is encoded or escaped, solved without breaking out at all
Cross-site scripting (XSS) 3 min -
Easy
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped
Stored XSS into an onclick handler where angle brackets and double quotes are HTML encoded and single quotes and backslash escaped, solved by smuggling the quote in as the ' entity
Cross-site scripting (XSS) 2 min -
Easy
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped
Reflected XSS in a JavaScript string where angle brackets and double quotes are encoded and single quotes escaped
Cross-site scripting (XSS) 3 min -
Easy
Reflected XSS into a JavaScript string with single quote and backslash escaped
Reflected XSS inside a JavaScript string where single quotes and backslashes are escaped, solved by ignoring the string and closing the whole script block with </script> then opening a fresh one that runs alert
Cross-site scripting (XSS) 3 min -
Medium
Reflected XSS in canonical link tag
Reflected XSS in the canonical link tag where angle brackets are escaped, solved in Chrome by breaking out of the href with a quote to graft on accesskey and onclick so the victim's keypress fires alert
Cross-site scripting (XSS) 5 min