Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

This scrappy setup got him 10+ account takeovers on the same program 👇🏼

15,634 Aufrufe • vor 1 Monat •via X (Twitter)

5 Kommentare

Profilbild von Bug Bounty Village
Bug Bounty Villagevor 1 Monat

At DEF CON 33, @PayPal hall of fame hacker @nytr0gen_ recalls stealing cookies from a web app behind an Akamai CDN. The app ran attacker-controlled input inside JSON responses. But the input type? Edge Side Includes, a markup language from 2004. #throwBackThursday

Profilbild von Bug Bounty Village
Bug Bounty Villagevor 1 Monat

@nytr0gen_ Web apps protect their cookies from XSS with `HttpOnly`. But ESI markup runs server-side, so an attacker can read those cookies anyway. The lesson? Obscure tech = completely new attack surface. Read those docs. Full talk:

Profilbild von unknown
unknownvor 27 Tagen

how to do this??

Profilbild von Bug Bounty Village
Bug Bounty Villagevor 26 Tagen

Watch the full video!

Profilbild von Krishna Sharma
Krishna Sharmavor 26 Tagen

@zseano @grok explain

Ähnliche Videos