Doing security research / CTF Player @_PwnSec_ (≧◡≦)
Joined July 2022
- Tweets22
- Following203
- Followers83
- Likes577
I just saw this. I'm pretty sure that's not a solve; it's AI hallucination. The embedded page prop is on the attacker's domain, not the target's, which indicates that it's an attacker-controlled alert message.
Gave the CTF to @neo_ai_engineer with no extra prompt, just the instructions on the page. It solved it and wrote a writeup while I was busy.
It acts like a curious kid who learns by trying things.
Macabely retweeted
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀
github.com/WICG/declarative-…
ALT https://yeswehack.github.io/Dom-Explorer/shared?id=e7b1b80d-8bd8-4643-bab0-de6898d7b35b
Macabely retweeted
"We used to be magician on the board ... and now it's just like press a button and there's no mystery anymore" - @MagnusCarlsen on how chess changed once engines came along
I'm getting pretty much the same vibes from the AI in CTF...
(and IT/InfoSec in general)
I solved it with a little trick i saw while studying xss. Cool chall
Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only!
xss.hashkitten.io/xss1.html
Macabely retweeted
i wrote a blog about the art of xs-leak attacks, i did a deep dive into chromium source code for an xs-leak oracle, have fun 😄
x6vrn.github.io/xsleaks-part…
Macabely retweeted
واحد لقي ثغرة واتقفلت له P5/informative وخلاص
يسكت؟ لا
بص الرايتاب بتاعي الفاجر وانا جايب critical من اللي بتموت كريتيكال من اللي ف قلب ال infrastructure من جوا خالص 💔
≧◡≦
Can you spot the XSS vulnerability? 👀
Test it out live at: pwnbox.xyz
ALT https://github.com/VoorivexTeam/white-box-challenges/blob/main/MisParse/index.js
