IAmMandatory
thehackerblog.com
Road Transport
Application Security
As featured in
Claim pageClaim
Follow
Overview
Connections
News
Salaries
Products
People
Growth
Offices
Financials
News
"Zero-Days" Without Incident - Compromising Angular via Expired npm Publisher Email Domains
NOTE: If you're just looking for the high level points, see the " The TL;DR Summary & High-Level Points " section of this post. Recently I took an interest in the npm registry due to it's critical role in the security of managing packages for all of JavaS
Read more
Report
Fishing the AWS IP Pool for Dangling Domains
Matt Bryant goes IP fishing in the AWS pool. Read about how he did it - and why expired digital assets can pose a threat.
Read more
Report
Video Downloader and Video Downloader Plus Chrome Extension Hijack Exploit - UXSS via CSP Bypass (15.5 Million Affected)
Note: This post is going to be a bit different from the previous Chrome extension vulnerability writeups. I'm going to actually walk through the code along with you to show you how tracing through an extension generally works. For this reason the whole th
Read more
Report
Report
Kicking the Rims - A Guide for Securely Writing and Auditing Chrome Extensions
A Thin Layer of Chrome Extension Security Prior-Art Chrome extension security and methodologies for auditing Chrome extensions for vulnerabilities appears to be a topic with shockingly little prior art. Especially when compared to other platforms such as
Read more
Report
Steam, Fire, and Paste - A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper
A Hacker
Read more
Report
Steam, Fire, and Paste - A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper
Summary The "Steam Inventory Helper" Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting (XSS) and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the hig
Read more
Report
Show more news