Hacking Chess.com and Accessing 50 Million Customer Records
Target Program: Chess.com
🎯 Vulnerability: Cross-Site Scripting (XSS)
💡 Defense Fix: Enforce Context-Aware Output Encoding, strict Content-Security-Policy (CSP), and HttpOnly cookie flags.
More Writeups Like This
pentester.land
by 0xrz (@omidxrz)$9240 Bounty in 30 days Hunt Challenge
pentester.land
by Eaton Z. (@XeEaton)How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System
pentester.land
by Yakir Kadkoda, Ofek Itach, Michael KatchinskiyBucket Monopoly: Breaching AWS Accounts Through Shadow Resources
pentester.land
by Oliver Brooks