0CTF/TCTF 2018 Quals h4x0rs.space Writeup (Web 1000)
0ctf_h4x0rs.space.md 0CTF/TCTF 2018 Quals h4x0rs.space Writeup (Web 1000) 問題 I've made a blog platform let you write your secret. Nobody can know it since I enabled all of modern web security mechanism, is it cool, huh? Get `document. cookie` of the admin. h4x0rs.space 解法(ざっくり) 第一段階: ファイルアップロード + AppCache で XSS 第二段階: JSONP + Service Worker でXSS 解法(くわしく) 概観 ブログを書けるWebアプリケーション ブログでは、 [tag]text[/tag]
An Abusive Relationship with AngularJS
The document discusses security issues with AngularJS and summarizes four general attack vectors: A1: Attacking the AngularJS sandbox by bypassing restrictions on dangerous objects and methods. Early versions had trivial bypasses but later versions required more creative techniques. A2: Attacking the AngularJS sanitizer, which aims to sanitize HTML strings and remove XSS attacks. There were issues
Scriptless Attacks - Stealing the Pie without touching the Sill
Scriptless Attacks - Stealing the Pie without touching the Sill - The document discusses scriptless attacks that can bypass traditional XSS defenses like NoScript and XSS filters by leveraging new HTML5 and CSS features. - It presents several proof-of-concept attacks including using CSS to steal passwords, using SVG fonts to brute force CSRF tokens, and using custom fonts to leak sensitive informa
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
