PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Challenge Two - Stranger XSS

lab.ctbb.show | research | #xss | #challenge | #writeup | #ctbb
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The second challenge of an XSS miniseries leading up to a writeup on a bug in an open source library.
Published
Collected

Related coverage

research · lab.ctbb.show
Challenge One - Strange XSS
A cool challenge introducing an XSS miniseries leading up to a writeup on a bug in an open source library.
research · lab.ctbb.show
The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
# The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework ~/authors/xssdoctor - profile xssdoctor * * * Jonathan Dunn Apr 02, 2026 _How I mapped the decoding...
research · lab.ctbb.show
Slacker Slash: Bypassing Bun Security Middleware via Normalization Desync
How WHATWG URL compliance in Bun creates a normalization desync with POSIX utilities, enabling double-slash and partial-path middleware bypasses.
research · lab.ctbb.show
Can a Predicted window.open Target Really Be That Impactful?
# Can a Predicted `window.open` Target Really Be That Impactful? ~/authors/alienisgrinding - profile alienisgrinding * * * Achbani Ismail Feb 25, 2026 > **TL;DR:** A predictable `window.open()`...
research · lab.ctbb.show
Azure DevOps Agent Interception
Pivoting from a compromised Windows VM to the cloud by intercepting Azure DevOps Agent traffic
research · lab.ctbb.show
Achieving remote code execution in LangSmith Playground using unsafe template formatting
This post details the discovery and exploitation of a vulnerability in LangSmith Playground that allowed arbitrary code execution through unsafe template formatting
Back