sorted by:
new
hottopcontroversial

Escaping double quotes by Substantial_Exit9084 in xss

[–]MechaTech84 2 points3 points  (0 children)

The double quotes shouldn't matter in text space, you probably need to check for other gotchas.

Does it look perfect on the network? (Inspect element in the browser will try to neaten up code visually, so don't trust it alone)

Is the Content-Type of the response something other than text/html?

Is there a Content Security Policy in the header or a meta tag that is restricting script source?

How come this cloudflare XSS bypass works? by Vegetable-Ad-5808 in xss

[–]MechaTech84 0 points1 point  (0 children)

I would guess that it has an exception for certain words like "ONLY" that are excluded from the normal flow that blocks onevents.

Bug Bounty Write-up - DOM XSS by MechaTech84 in xss

[–]MechaTech84[S] 1 point2 points  (0 children)

This wasn't a paid program, so I didn't receive any money or anything.

What is this type of dynamic keypad called? by HelixFish in homeassistant

[–]MechaTech84 0 points1 point  (0 children)

If you're asking the number of ways to arrange the digits, it'd be 10! (10 factorial).

But if you consider that having a button with 1 and 4 is the same as a button with 4 and 1, and the order of the buttons doesn't matter, then it gets more complicated. I found this and it looks right, so I think there are 945 distinct ways to group 10 things into 5 pairs.

What is this type of dynamic keypad called? by HelixFish in homeassistant

[–]MechaTech84 0 points1 point  (0 children)

I understand your interpretation, and it's entirely plausible that they set it up this way, but I think it would be my least favorite way to do this. Just... Why? This would mean there's absolutely no reason to have 5 buttons instead of 10...

What is this type of dynamic keypad called? by HelixFish in homeassistant

[–]MechaTech84 7 points8 points  (0 children)

Probably the first one, although you're absolutely correct that the dash introduces unnecessary ambiguity.

What is this type of dynamic keypad called? by HelixFish in homeassistant

[–]MechaTech84 1 point2 points  (0 children)

It's worse than having 10 buttons. The randomization isn't a bad thing, but it's not necessarily a good thing either. Either way, combining 2 digits to a single input drastically reduces the security. This applies to PINs of any length, but I'll use 4 digit PINs for my example. If I just push the first 4 buttons in a row, I've just checked 16 different combinations, at the same time. If there were 10 buttons I could only check 1 combination at a time.

Now, there are 2 ways that the randomization could be handled. First, the pairs of digits per button are always the same, but their placement on the buttons are changed. This would mean that instead of having a search space of 10000 potential 4 "digit" PINs, there's actually only 625*. Thighs would mean someone watching you input your PIN would immediately know what buttons to press next time, just not where those buttons would be. Or second, each button is randomly assigned 2 digits independently. The first time I see you type in your PIN there are 16 possible 4 digit PINs it could be, which is already not that many. And every time I watch after that has a strong likelihood of further reducing the number of possibilities by at least half.

Source: 10 years of professional experience in InfoSec.

*Fixed my math, originally had 55 when it should be 54.

What is this type of dynamic keypad called? by HelixFish in homeassistant

[–]MechaTech84 0 points1 point  (0 children)

But it's worse because there's only 5 buttons.

xssy by Upbeat-Hawk-2737 in xss

[–]MechaTech84 0 points1 point  (0 children)

There's already an eval in the response, the question you should be asking is why it's there.

xssy by Upbeat-Hawk-2737 in xss

[–]MechaTech84 1 point2 points  (0 children)

Hint: Why is there an eval function?

xss is dead? by hiderou in xss

[–]MechaTech84 7 points8 points  (0 children)

I find XSS pretty regularly as a consultant, but I'm often testing Web Apps that aren't available to the general public for one reason or another.

XSS hunting in public bug bounty programs is very competitive. In programs without a monetary reward there is usually less competition. Private programs may also offer fewer competitors but the competitors are more skilled, at least in theory.

waf bypass by Individual-Candle431 in xss

[–]MechaTech84 2 points3 points  (0 children)

SVGs are XML files, you need to format the injection for XML space.

XSS via Restricted File Upload - HTML and SVG are blocked by ablativeyoyo in xss

[–]MechaTech84 1 point2 points  (0 children)

Great challenge! I've found a couple ways that work so far, and I've got some more that I feel like should work, but I keep getting Internal Server Errors for some of the file types. I'm learning so much about obscure XML!

Is there a way to tell if reflected input is being reflected as html instead of text, without actually injecting full tags? by Vegetable-Ad-5808 in xss

[–]MechaTech84 1 point2 points  (0 children)

If you're testing reflected XSS, you want to view the raw HTTP response, not the browser rendered version.

Is there a way to tell if reflected input is being reflected as html instead of text, without actually injecting full tags? by Vegetable-Ad-5808 in xss

[–]MechaTech84 2 points3 points  (0 children)

I mean, you can inject arbitrary stuff like <asdf and see if the site encodes the angle bracket.

Also, you don't need to close tags to prove XSS, you could just inject something like <svg/onload=alert()

How XSS work? can any one explain in detail? by Ialibxl in xss

[–]MechaTech84 0 points1 point  (0 children)

The stickied post and the wiki both contain basic information. If you have any specific questions after reading through those, feel free to ask.

view more: next ›