Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

This scrappy setup got him 10+ account takeovers on the same program 👇🏼

15,634 görüntüleme • 1 ay önce •via X (Twitter)

5 Yorum

Bug Bounty Village profil fotoğrafı
Bug Bounty Village1 ay önce

At DEF CON 33, @PayPal hall of fame hacker @nytr0gen_ recalls stealing cookies from a web app behind an Akamai CDN. The app ran attacker-controlled input inside JSON responses. But the input type? Edge Side Includes, a markup language from 2004. #throwBackThursday

Bug Bounty Village profil fotoğrafı
Bug Bounty Village1 ay önce

@nytr0gen_ Web apps protect their cookies from XSS with `HttpOnly`. But ESI markup runs server-side, so an attacker can read those cookies anyway. The lesson? Obscure tech = completely new attack surface. Read those docs. Full talk:

unknown profil fotoğrafı
unknown27 gün önce

how to do this??

Bug Bounty Village profil fotoğrafı
Bug Bounty Village27 gün önce

Watch the full video!

Krishna Sharma profil fotoğrafı
Krishna Sharma27 gün önce

@zseano @grok explain

Benzer Videolar