filmov
tv
Prototype Pollution, reCAPTCHA and XSS - Solution to June '23 Challenge
Показать описание
🏆 The official writeup for the June '23 Challenge. There's at least 3 possible solutions, all featuring prototype pollution (jquery 2.2.4 - deparam) and XSS 😎
The differences will be outlined in the video, but a quick summary:
1) Intended: Pollute Sanitizer() config to allow unknown markup and the Google reCAPTCHA related attributes.
2) Unintended #1: Use reCAPTCHA (srcdoc, like intended) as a gadget without changing Sanitizer config (pollute sitekey).
3) Unintended #2: Use jquery script gadgets ($(x).off - delegateTarget), bypassing reCAPTCHA and the domain check.
00:00 Intro
01:55 Enable Sanitizer API in Firefox
02:41 Explore site functionality
03:38 Source code review
08:32 Setup challenge (local environment)
10:06 jquery 2.2.4 deparam prototype pollution
12:45 reCAPTCHA as a gadget
15:01 Pollute Sanitizer() config
18:37 Bypassing the domain check (remote)
20:51 Summary of intended solution
22:04 Bonus: Unintended #1 - reCAPTCHA sitekey pollution
23:17 Bonus: Unintended #2 - jquery script gadgets
25:02 Recap
26:24 Conclusion
The differences will be outlined in the video, but a quick summary:
1) Intended: Pollute Sanitizer() config to allow unknown markup and the Google reCAPTCHA related attributes.
2) Unintended #1: Use reCAPTCHA (srcdoc, like intended) as a gadget without changing Sanitizer config (pollute sitekey).
3) Unintended #2: Use jquery script gadgets ($(x).off - delegateTarget), bypassing reCAPTCHA and the domain check.
00:00 Intro
01:55 Enable Sanitizer API in Firefox
02:41 Explore site functionality
03:38 Source code review
08:32 Setup challenge (local environment)
10:06 jquery 2.2.4 deparam prototype pollution
12:45 reCAPTCHA as a gadget
15:01 Pollute Sanitizer() config
18:37 Bypassing the domain check (remote)
20:51 Summary of intended solution
22:04 Bonus: Unintended #1 - reCAPTCHA sitekey pollution
23:17 Bonus: Unintended #2 - jquery script gadgets
25:02 Recap
26:24 Conclusion
0:27:03
Prototype Pollution, reCAPTCHA and XSS - Solution to June '23 Challenge
0:13:53
Prototype pollution in Google Analytics?! Solution to August '21 XSS Challenge
0:09:07
Prototype Pollution: DOM XSS via client-side prototype pollution
0:13:48
Prototype pollution is everywhere! Solution to May '22 XSS Challenge
0:01:15
DOM XSS via an alternative prototype pollution vector
0:00:59
What is Prototype Pollution?
0:21:01
DOM Invader: Prototype Pollution
0:56:13
Web Security Academy | Prototype Pollution | 1 - DOM XSS Via Client-Side Prototype Pollution
0:00:42
What are Prototype pollution vulnerabilities | OWASP Top 10 | Bug Bounty Service LLC
0:03:52
Testing for prototype pollution with DOM Invader
0:01:47
Client-side prototype pollution in third-party libraries
0:15:49
Михаил Ефанов — XSS на GitLab через prototype pollution
0:12:57
SnykCon CTF - 'Invisible Ink' Prototype Pollution
0:00:13
Prototype Pollution labs on portswigger #burp #bounty #ctf #short
0:15:01
Understanding JavaScript Prototypes & Prototype Pollution Attacks
0:10:31
How to solve Prototype Pollution CTF challenges?
0:03:40
Exfiltrating sensitive data via server-side prototype pollution
0:29:22
Web Security Academy | Prototype Pollution | 4 - Client-Side Prototype Pollution Third-Party Library
0:01:01
Bypassing flawed input filters for server side prototype pollution
0:19:34
BUG BOUNTY: UNDERSTANDING PROTOTYPE POLLUTION VULNERABILITY | 2023
0:01:13
How you can hack a website with prototype pollution
0:05:07
Prototype Pollution | FooBar CTF | CTF For beginners
0:10:06
Web Hacking -Server-Side Prototype Pollution
0:28:05
🇫🇷 PROTOTYPE POLLUTION
Комментарии