PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Browser bugs vs. attacks on same origin policy

portswigger.net | blog | #browser-security | #web-security | #xss | #research | #portswigger | #same-origin-policy | #dns-rebinding | #json-hijacking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Dafydd Stuttard weighs browser 0days against same-origin-policy attacks: app defenses can't survive a compromised browser, but SOP bypasses still matter as web security is a weakest-link problem.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
research · yokai.hakaisecurity.io
SQL Injection and XSS Vulnerability on Centreon
I’m Daniel França Lima and i’m a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and network asset monitoring solution based […]
Back