PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HTML facts﹕ <​in​put ​ty​pe=​”i​mag​e”​> a​nd a <​f​ram​e​> XSS bypass

lab.ctbb.show | research | #html | #input-image | #frame | #trivia
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Two HTML fun facts: sending mouse-coordinates & using the tag for XSS filter bypasses
Published
Collected

Related coverage

blog · bughunters.google.com
Escaping '<' and '>' in attributes – how it helps protect against mutation XSS
Google's Bug Hunters explain why the HTML standard now escapes angle brackets in attribute values and how this change helps prevent mutation XSS (mXSS) attacks.
blog · portswigger.net
Implementing Tic Tac Toe with 170mb of HTML - no JS or CSS
Gareth Heyes builds Tic Tac Toe using only HTML and Chrome's experimental popover feature — no JavaScript or CSS — by brute-force generating 170MB of markup covering every possible game state.
blog · portswigger.net
[MoBP] New message analysis views
Burp's message view tabs now appear contextually based on message content, with new colourised HTML and XML views that make it easy to visually parse responses and sanity-check edited markup.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · crowdstrike.com
Build an Intelligence Advantage with Falcon Next-Gen SIEM
Falcon Next-Gen SIEM unifies threat intelligence with security telemetry to strengthen detection, accelerate investigations, and build a smarter foundation for the agentic SOC.
Back