Mathias Karlsson (@avlidienbrunn) / X

do we still care about xss in void/hidden elements? ff only (visit URL#p): <meta name="description" content="hello" id="p" hidden="until-found" onbeforematch="alert(document.domain)"> <input type="hidden" id="p" hidden="until-found" onbeforematch="alert(document.domain)">

1

Mathias Karlsson

@avlidienbrunn

Jul 1

Some additional context: S3 bucket doesnt have to be public, cdns can have builtin signing (ie bucket/object is private, but cdn has keys to sign). This works if the cdn/middleware forwards query (or if query can be smuggled).

AmirMohammad Safari

@AmirMSafari

Jun 30

If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post: blog.voorivex.team/content-type-o…

I made a tool to help test archive (zip/tar) extraction bugs (synk working directory into archive, add path traversals, links, permissions, etc):

GitHub - avlidienbrunn/archivealchemist: Archive Alchemist is a tool for creating specially crafted...

I made a tool to compare/test server-side HTML parsers: htmlparse.hackaplaneten.se . How many "server-side mXSS" can you find? :)

Did you know that JS supports shebang as a comment, and that multiline comments change behaviour depending on what they contain? Is there more?avlidienbrunn.se/jscomments.php

5

­Mathias Karlsson

Mathias Karlsson