Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Medium
Reflected XSS with some SVG markup allowed
Reflected XSS where common tags are blocked but SVG slips through
Cross-site scripting (XSS) 6 min -
Easy
Reflected XSS into HTML context with all tags blocked except custom ones
Reflected XSS where every standard HTML tag is blocked, escaped with a made up <xss> tag carrying onfocus that gets auto focused through a URL fragment to alert document.cookie on the victim
Cross-site scripting (XSS) 4 min -
Medium
Reflected XSS into HTML context with most tags and attributes blocked
Reflected XSS in a search box behind a WAF that blocks most tags and attributes, solved by brute forcing the allowed pair in Burp Intruder then firing <body onresize=print()> through an iframe that resizes itself on the victim
Cross-site scripting (XSS) 6 min -
Easy
Stored DOM XSS
Stored DOM XSS in the blog comments where a broken replace filter only encodes the first angle bracket, bypassed with a leading decoy pair so an <img onerror> payload survives and fires
Cross-site scripting (XSS) 3 min -
Medium
Reflected DOM XSS
Reflected DOM XSS where the server echoes your search into a JSON response that a client script feeds to eval
Cross-site scripting (XSS) 4 min -
Easy
DOM XSS in AngularJS expression with angle brackets and double quotes HTML encoded
DOM based XSS inside an AngularJS expression where angle brackets and double quotes are HTML encoded, solved by slipping an AngularJS template expression into the search that reaches the Function constructor to fire alert
Cross-site scripting (XSS) 3 min -
Easy
DOM XSS in document.write sink using source location.search inside a select element
DOM XSS where a storeId value from location.search is written into a select with document.write, solved by closing the select and injecting an img onerror that calls alert
Cross-site scripting (XSS) 3 min