正在加载视频...
视频加载失败
This scrappy setup got him 10+ account takeovers on the same program 👇🏼
15,716 次观看 • 1 个月前 •via X (Twitter)
5 条评论

Bug Bounty Village1 个月前
At DEF CON 33, @PayPal hall of fame hacker @nytr0gen_ recalls stealing cookies from a web app behind an Akamai CDN. The app ran attacker-controlled input inside JSON responses. But the input type? Edge Side Includes, a markup language from 2004. #throwBackThursday

Bug Bounty Village1 个月前
@nytr0gen_ Web apps protect their cookies from XSS with `HttpOnly`. But ESI markup runs server-side, so an attacker can read those cookies anyway. The lesson? Obscure tech = completely new attack surface. Read those docs. Full talk:

unknown1 个月前
how to do this??

Bug Bounty Village1 个月前
Watch the full video!

Krishna Sharma1 个月前
@zseano @grok explain

