[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias
Hacker TLDR;HTMX Bypasses CSP Bypass: HTMX triggers can be abused to bypass CSP’s via <img src=x hx-on:htmx:load='alert(0)' /> - full writeup below. Client-side response header injection to XSS: HTMX uses certain headers to help instruct the framework for certain behaviours. This can be abused via HX-Redirect: javascript:alert(1) for XSS if you can inject a response header. Bypassing hx-disable: h
![[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias](https://cdn-ak-scissors.b.st-hatena.com/image/square/b8c65f4910e79834cfcddd21a60954a9a0dbb036/height=288;version=1;width=512/https%3A%2F%2Fbeehiiv-images-production.s3.amazonaws.com%2Fuploads%2Fpublication%2Flogo%2Ff3cc9f6e-341e-452a-9b50-a244bcc4cf92%2FCritical_Thinking_Podcast_Cover_Square.jpg)
CVE-2023-5480: Chrome new XSS Vector
Chrome XSSThe article is informative and intended for security specialists conducting testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious programs, disruption of system operation, and violation of the confidentiality of correspondence are pursued by law. PrefaceThis article is dedi
Google deprecates XSS Auditor for Chrome
The age of browser XSS filters is over Google is removing XSS Auditor for Chrome after a series of vulnerabilities have plagued the hotly-contested security feature. The anti-cross-site scripting (XSS) technology is to be deprecated and removed, Chromium devs announced last night. XSS Auditor has generated more than a little controversy since it was implemented in Chrome v4 in 2010, with the disco
Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types | Articles | web.dev
Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types Stay organized with collections Save and categorize content based on your preferences. DOM-based cross-site scripting (DOM XSS) happens when data from a user-controlled source (like a username, or a redirect URL taken from the URL fragment) reaches a sink, which is a function like eval() or a property setter like .innerHTML
Vue.js で XSS を作り込まないために気を付けること - セキュアスカイプラス
The ultimate PHP Security Checklist
Product { this.openCategory = category; const productMenu = document.querySelector('.product-menu'); window.DD_RUM.onReady(function() { if (productMenu.classList.contains('show')) { window.DD_RUM.addAction(`Product Category ${category} Hover`) } }) }, 160); }, clearCategory() { clearTimeout(this.timeoutID); } }" x-init=" const menu = document.querySelector('.product-menu'); var observer = new Muta
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
