Video wird geladen...
Video konnte nicht geladen werden
This scrappy setup got him 10+ account takeovers on the same program 👇🏼
15,634 Aufrufe • vor 1 Monat •via X (Twitter)
5 Kommentare

Bug Bounty Villagevor 1 Monat
At DEF CON 33, @PayPal hall of fame hacker @nytr0gen_ recalls stealing cookies from a web app behind an Akamai CDN. The app ran attacker-controlled input inside JSON responses. But the input type? Edge Side Includes, a markup language from 2004. #throwBackThursday

Bug Bounty Villagevor 1 Monat
@nytr0gen_ Web apps protect their cookies from XSS with `HttpOnly`. But ESI markup runs server-side, so an attacker can read those cookies anyway. The lesson? Obscure tech = completely new attack surface. Read those docs. Full talk:

unknownvor 27 Tagen
how to do this??

Bug Bounty Villagevor 26 Tagen
Watch the full video!

Krishna Sharmavor 26 Tagen
@zseano @grok explain

