Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ActiveX + XSS = ActiveXSS Pwnage!

netspi.com | vulnerability | #pentesting | #fuzzing | #xss | #activex | #comraider | #client-side-attacks

Summary

After finding XSS in web apps running ActiveX plugins, NetSPI chains the two: extracting class IDs from page HTML, resolving the backing DLL via the registry, and fuzzing it with ComRaider.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.
vulnerability · netspi.com
CVE-2026-78902: XSS to RCE in pfSense with one DNS request
NetSPI reports CVE-2026-78902, a stored cross-site scripting issue in the pfSense pfBlockerNG package that can be escalated to remote code execution with a single DNS request.
vulnerability · netspi.com
CVE-2024-37888 – CKEditor 4 Open Link plugin XSS
CVE-2024-37888 is an XSS in CKEditor 4's Open Link plugin that lets crafted hyperlinks execute JavaScript in a victim's browser. Found during a client engagement, it affects latest plugin versions.
vulnerability · netspi.com
Weaponizing self-xss
Demonstrates turning self-XSS into real attacks, such as payloads that fire when admins view a user's profile, and suggests logging callbacks to prove impact when reporting these findings.
vulnerability · netspi.com
XSS Using Active Directory Automatic Provisioning
Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.
vulnerability · portswigger.net
Backslash Powered Scanning: hunting unknown vulnerability classes
James Kettle presents backslash-powered scanning: an approach that finds known and unknown classes of server-side injection flaws with a tiny network footprint, tested across thousands of sites.
back