pentester.land· Jun 25, 2023· by Aryan W13DOM (@NeuRosis23)

How I Hacked Scopely and Got $$$

Open Original Article ↗
Target Program: Scopely
🎯 Vulnerability: Cross-Site Scripting (XSS)
💡 Defense Fix: Enforce Context-Aware Output Encoding, strict Content-Security-Policy (CSP), and HttpOnly cookie flags.
#Self-XSS#Clickjacking#Account takeover

More Writeups Like This

pentester.land

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb, Login+Logout CSRF…

by Renwa (@RenwaX23)
pentester.land

Self-XSS to ATO via Site Features

by Hossein Shourabi (@hoseinshurabi)
pentester.land

Self XSS + Login CSRF + OAuth = Account Takeover

by LS (@Loupreme_)
pentester.land

Duplicate CSRF… Leads to

by Bhavesh aka ShellBreaker (@shellbreaker_)