terjanq

terjanq

@terjanq.me

security enthusiast that loves hunting for bugs in the wild. co-founder and player of @justCatTheFish. infosec at @google. opinions are mine. From: https://twitter.com/terjanq

2.5K followers150 following37 posts

Pinned

terjanq
@terjanq.me

Extended the starter with shy writers! 😀 If you're not on the list but write about web security, then feel free to reply with the article you're most proud of, and I will add you to the pack! Make sure to resubscribe to not not miss on the amazing 🌐research! go.bsky.app/9JXnB17

terjanq reposted

Jorian
@jorianwoltjer.com

During #x3ctf, I discovered an unintended solution that turned out to be a pretty cool generic technique. It allows you to detect the result of a selector during CSS Injection, bypassing any CSP restricting external requests! Check out the writeup below: jorianwoltjer.com/blog/p/ctf/x...

jorianwoltjer.comPost: x3CTF - blogdog (+ new CSS Injection XS-Leak!) | Jorian WoltjerA "hard web xssbot" challenge about a fun browser quirk with the is= attribute to perform CSS Injection. Bypass the strict CSP with an unintended new technique to XS-Leak a selector's result by detect...

terjanq reposted

Johan Carlsson
@joaxcar.bsky.social

Here is (finally) the writeup and conclusion of the challenge: joaxcar.com/blog/2024/12... Maybe not the best write-up, but I have to allow myself to actually post, rather than refactor, posts. I hope someone finds it useful. And thanks everyone that participated. Special shoutout to @terjanq.me

joaxcar.comSideloading external scripts: a code golf challenge - Johan Carlsson
Johan Carlsson@joaxcar.bsky.social

A small code-golf web challenge (free research from you, for me), how short can you make a "fetch content and execute it inline". There is a CSP in a meta tag. Goal: get the content from the file hack.js and have it inserted in the page. like in the image joaxcar.com/xss/self.html

terjanq
@terjanq.me

Got sniped into the challenge and ended up doing some cool XSS research :D 11 char XSS with mind-boggling race-conditions. TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char) It's shorter than location=name !! terjanq.me/solutions/jo...

terjanq.me11 char XSS (slow race-condition)
Johan Carlsson@joaxcar.bsky.social

A small code-golf web challenge (free research from you, for me), how short can you make a "fetch content and execute it inline". There is a CSP in a meta tag. Goal: get the content from the file hack.js and have it inserted in the page. like in the image joaxcar.com/xss/self.html

terjanq
@terjanq.me

Managed to greatly improve: * performance * accurracy * cross-platform support (should now work on both Chrome & Firefox) Check out the updated version! 😃

terjanq
@terjanq.me

Great article about mXSS by @jorianwoltjer.com!

Jorian@jorianwoltjer.com

To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all. If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this! jorianwoltjer.com/blog/p/hacki...

jorianwoltjer.comPost: Mutation XSS: Explained, CVE and Challenge | Jorian WoltjerLearn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online
terjanq
@terjanq.me

Looks like @webtonull.bsky.social wasn't able to bypass ModSecurity after fixes to the reported bugs! 😅 Nevertheless, parsing RFC is still pain, especially that the RFC isn't very specific about handling edge cases. Highly recommend reading the whole article.

terjanq reposted

April King
@april.social

Handling Cookies is a Minefield: Inconsistencies in the HTTP cookie specification and its implementations have caused a situation where countless websites (including Facebook, Netflix, Okta, WhatsApp, Apple, etc.) are one small mistake away from locking their users out. grayduck.mn/2024/11/21/h...

You are up to date.