pentester.land· Feb 6, 2024· by Omar (@0x0ld)

Null Byte on Steroids

Open Original Article ↗
Target Program: -
🎯 Vulnerability: Cross-Site Scripting (XSS)
💡 Defense Fix: Enforce Context-Aware Output Encoding, strict Content-Security-Policy (CSP), and HttpOnly cookie flags.
#Null-Byte injection#Account takeover#Password reset#SQL injection#Path traversal#XSS#WAF bypass

More Writeups Like This

pentester.land

Sign-in with World ID: XSS and ATO via OIDC Form Post Response Mode

by Lauritz Holtmann (@_lauritz_)
pentester.land

Taking over accounts in multiple ways

by vict0ni (@vict0ni)
pentester.land

How I found multiple critical bugs in Red Bull

by Bartłomiej Bergier (@_bergee_)
pentester.land

We discovered major vulnerabilities in Control Web Panel. Here’s how we found them.

by Immersive Labs (@immersivelabs)