PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fuzzing for XSS via nested parsers condition

swarm.ptsecurity.com | research | #fuzzing | #web-security | #xss | #research | #parsers
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A fuzzing technique for finding XSS in message-markup parsers (BBCode, Markdown, AsciiDoc, reStructuredText) by exploiting nested parser conditions, which uncovered vulnerabilities in popular products that had gone unnoticed. Presented at Power of Community 2021.
Published
Collected

Related coverage

research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
research · yokai.hakaisecurity.io
SQL Injection and XSS Vulnerability on Centreon
I’m Daniel França Lima and i’m a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and network asset monitoring solution based […]
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
Back