PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

DOM Clobbering strikes back

portswigger.net | research | #browser-security | #xss | #research | #portswigger | #client-side | #dom-clobbering
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes revives DOM Clobbering with new techniques for clobbering three levels deep via DOM collections, plus interactive labs, after the technique was used to exploit GMail.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
research · yokai.hakaisecurity.io
SQL Injection and XSS Vulnerability on Centreon
I’m Daniel França Lima and i’m a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and network asset monitoring solution based […]
Back