$25k GitHub account takeover & justCTF 2023 CSRF+XSS writeup

[@BugBountyReportsExplained]

💻 Challenge yourself in 2024 justCTF online teaser: 2024.justctf.team
Sponsored by:
HexRays - get 20% off for IDA pro training sessions with exclusive code BBRE20: bbre.dev/hexrays
Trail of Bits: cutt.ly/veucZatb
OtterSec: cutt.ly/leucL7cz
SECFORCE: cutt.ly/5eoKRyNL

[@princewilliam7876]

Where I can learn more about namespace tokenizor and parser

[@BugBountyReportsExplained]

look for mutation xss. Articles by Michał Bentkowski are great. Also, recently in BBRE Premium I covered a talk about it

[@Zizo8182]

Thanks for sharing

[@monKeman495]

is preflight request with strict referer or sop policy before post or put request can thwart the payload ?

[@BugBountyReportsExplained]

thwart?

[@monKeman495]

@@BugBountyReportsExplained sorry it's stop , in my case program use put method for adding information to account but put method block the cors request .so i tried using __method=get and some other tricks like using in with origin set with src but no luck

[@eduardopereira2718]

really cool video. thanks

[@Username8281]

Amazing channel. Does anyone know any similar channels?

[@kuroketsueki9059]

Nahamsec but BBRE is more detailed IMO

[@PhilocyberWithRichie]

No fucking way you have a Mate behind you!! hahaha you are great dude! Good video thanks for sharing!

[@BugBountyReportsExplained]

Mate is now my necessary equipment for work😏

[@steiner254]

nice!

[@Quantum_Playz78]

2nd view × 2nd comment × 2nd liked = 1 subscriber. Fact I already subscribed your channel more than a year.

[@zzzzzzzzZzZZzzzaZzz]

Thanks for your report and efforts. Unfortunately, the vulnerability has already been reported and thus your report will be marked as duplicate

[@ediopaul0]

@@zzzzzzzzZzZZzzzaZzz LOL

[@0xshahriar]

1st view + 1st comment

[@data_eng_tuts]

Yeah, bug bounty hunting is shit !