Loading video...
Video Failed to Load
This scrappy setup got him 10+ account takeovers on the same program ๐๐ผ
15,634 views โข 1 month ago โขvia X (Twitter)
5 Comments

Bug Bounty Village1 month ago
At DEF CON 33, @PayPal hall of fame hacker @nytr0gen_ recalls stealing cookies from a web app behind an Akamai CDN. The app ran attacker-controlled input inside JSON responses. But the input type? Edge Side Includes, a markup language from 2004. #throwBackThursday

Bug Bounty Village1 month ago
@nytr0gen_ Web apps protect their cookies from XSS with `HttpOnly`. But ESI markup runs server-side, so an attacker can read those cookies anyway. The lesson? Obscure tech = completely new attack surface. Read those docs. Full talk:

unknown28 days ago
how to do this??

Bug Bounty Village28 days ago
Watch the full video!

Krishna Sharma28 days ago
@zseano @grok explain

