Professional Vulnerability Developer | Wannabe Security Researcher
127.0.0.1
Joined April 2016
- Tweets527
- Following459
- Followers2.1K
- Likes942
Pinned Tweet
Just published a writeup on my account takeover vulnerability in ChatGPT, using a really cool web cache deception technique. Waited a while to finally publish this, enjoy :)
nokline.github.io/bugbounty/…
Harel retweeted
In !BS 0x03, @yoyosh__ gave a talk about his RCE exploit in Redis, which won him a $30k bounty during Wiz’s zeroday.cloud competition. His talk is now published on our YouTube channel, you can watch it here
youtu.be/3vAtTPrxQJY?si=W5XX…
Used this technique in my Zoom session takeover bug to increase availability impact. Very cool to see this being abused with marketing cookies to make this even more generic!
Excited to unveil our latest research for the #security community!
"From Query Param to Cookie Poisoning: How WAFs Fail at Security"
Check out the full write-up here 👉 medium.com/@blogwithsarthak/…
#bugbounty #cybersecurity #waf #Infosec #writeups #websecurity #bugbountytips
It works by using the meta tag to redirect the user to a mailto: scheme. This will not actually redirect the user, but will pop an email box which will steal the window’s focus and trigger the onblur event.
XSS payload that triggers onblur without user interaction. It also works for onfocusout
<bla tabindex=1 onblur=alert(1) autofocus></bla><meta http-equiv="refresh" content=1;URL=mailto:[email protected]">