DOM XSS, voicemail ATO, and 10K4ILF

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Finding DOM Polyglot XSS in PayPal the Easy Way

   Finding DOM XSS can be tricky when it's buried in thousands of lines of code. PortSwigger recently developed DOM Invader to help tackle this using a combined dynamic+manual approach to vulnerability discovery, and promptly found an interesting polyglot DOM XSS affecting PayPal.

   Read : Finding DOM Polyglot XSS in PayPal the Easy Way
2. /02

   Taking over Uber accounts through voicemail

   When creating an authentication flow, so many parameters have to be taken into account. The originating IP address, the number of attempts before a lockout, rate limits, 2FA verification options and sign in methods.

   Read : Taking over Uber accounts through voicemail
3. /03

   Live Recon on Rockstar Games With zseano

   zseano shares his methodology and how he utilizes different tools like burp suite to look for vulnerabilities! He also shows his testing flow for different vulnerabilities like XSS and open redirect!

   Watch : Live Recon on Rockstar Games With zseano
4. /04

   Fleex

   allows you to create multiple VPS on cloud providers and use them to distribute your workload. Run tools like masscan, puredns, ffuf, httpx or anything you need and get results quickly!

   Read : Fleex
5. /05

   Extended BApp Store

   The extended BApp store for all your Burp Suite extension needs!

   Read : Extended BApp Store