Detectify
Detectify’s knowledge advisor Frans Rosén wrote a blog post for the Bugcrowd about using a Braun Shaver to Bypass XSS Audit and WAF. Bugcrowd is a crowdsourced cybersecurity platform where hackers take part in bug bounty programs, helping companies fix vulnerabilities.
Read more at the Bugcrowd blog for a write-up featuring an XSS exploit and a personal hygiene product.
TL/DR: In this world of rapid digitization, companies are moving from traditional on-premise deployments to cloud service providers for handling their infrastructure. In this article, …
TL;DR Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to an attacker. This could be used in attacks for single-click account takeovers. Frans Rosén, Security Advisor at Detectify goes through three different scenarios found in the wild below.
