/Hive Five #88 · Sep 26, 2022
The Age of Universal XSS, and One Takeover to Rule Them All
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
The Age of Universal XSS
In August 1996, Internet Explorer joined the JavaScript security scene after they added JScript. During this era from around 1996-2000, tons of bugs were found what we would call today "Universal Cross-site Scripting".
Watch : The Age of Universal XSS -
Pre-Auth Remote Code Execution - Web Page Test
Louka's first ManoMano article, since joining in early April 2022.
Read : Pre-Auth Remote Code Execution - Web Page Test -
Breaking Bitbucket - Pre Auth Remote Command Execution (CVE-2022-36804)
Often when performing application security research, they come across other researchers who have found critical vulnerabilities in software that can inspire them to dig deeper as well. This was the case when they read the blog post from William Bowling about his RCE finding in GitHub Enterprise.
Read : Breaking Bitbucket - Pre Auth Remote Command Execution (CVE-2022-36804) -
One takeover to rule them all
Because of Covid, the first quarantine in France occurred in March 2020. During that time Gwendal wrote a Python script to detect Subdomain Takeover.
Read : One takeover to rule them all -
Fuzzing XSS Sanitizers for Fun and Profit | Tom Anthony
In 1998 Tom was arrested for hacking, and was told he was looking at over 270 years in prison. Time for a career change! Tom went on to a life as an academic, earning a PhD in Artificial Intelligence, before starting a career as an SEO consultant (you think telling people you are a hacker is bad).
Watch : Fuzzing XSS Sanitizers for Fun and Profit | Tom Anthony