DOM XSS @DOMXss

We retweet your #DOMXSS news and findings Joined March 2011

Tweets

463
Followers

2K
Following

0
Likes

6

XSS Payloads @XssPayloads

7 years ago

Coinbase AngularJS DOM XSS via Kiteworks: nice write-up by @PaulosYibelo bit.ly/2Mfb3SZ

0 52 116 0 5

DOM #XSS, it's time to say goodbye. See the newest status update on Trusted Types, delivered at #w3ctpac. The simplest polyfill is a tiny TrustedTypes={createPolicy:(n,rules)=>rules} (yes, that can help end DOM XSS), but there's so much more good news! tinyurl.com/tttpac

2 48 101 0 4

payloadartist @payloadartist

7 years ago

Writeup: DOM Based XSS in Alibaba's *.ucweb.com by @sudhanshur705 medium.com/@sudhanshur705… #bugbounty #infosec #pentest #exploit #PoC #cybersecurity #hacking

3 56 146 0 8

ISWAT @ISWATLAB

7 years ago

[RecentQuestions] Is this code vulnerable to DOM based XSS jquery animate? dlvr.it/Qv7wRy [sec.stackexchange]

0 2 2 0 1

Emad Shanab - أبو عبد الله @Alra3ees

7 years ago

DOMXSSHilight:- Burp Extension in Python hilighting DOM Sinks and Sources using DOM XSS Wiki regex. github.com/sechacking/DOM…

1 14 37 0 7

JSFoo @jsfoo

7 years ago

"At @GoogleVRP, DOM based cross-site scripting is already the most common variant of XSS" @lavakumark

0 2 3 0 1

RIVER @wugeej

7 years ago

[Tool] XSStrike v3.0 - Most Advanced XSS Detection Suite Reflected and DOM XSS Scanning Multithreaded crawling Context analysis Configurable Core Highly Researched Workflow WAF detection & evasion Handmade HTML & JavaScript parser Powerful fuzzing engine github.com/s0md3v/XSStrike

0 2 4 0 0

Anant Shrivastava @anantshri

7 years ago

Intelligent work by @lavakumark in DOMGO.AT selecting debug flag enables pre assigned debug locations to facilitate understanding of domxss working.

0 4 4 0 1

Download Image

techfindr @techfindr

7 years ago

The newly discovered DOM-XSS vulnerability affects Tinder, Shopify, Yelp and many other. #DOM-XSS #hackers #security #cyber ow.ly/DNDc30mfswg

0 1 0 0 0

Download Image

Mohamed Haron @m7mdharon

7 years ago

Seems that Hackerone staff give duplicate for the good reports and when you ask an invite to the main report .. the response is great too ( not duplicate) hackerone.com/reports/405191

0 1 3 0 0

YS @YShahinzadeh

7 years ago

WTF is that? hackerone.com/reports/418078

0 3 8 0 0

SEC Consult @sec_consult

7 years ago

What you see is not all you get: #XSS vulnerability in @KendoUI Editor allows remote attackers to inject arbitrary #JavaScript into the DOM of the #WYSIWYG editor r.sec-consult.com/kendo No Patch, but workaround by vendor #HTML #vulnerability #kendo #infosec

0 9 11 0 0

Download Image

n00py @n00py1

7 years ago

Poll for web app testers: when Burp finds DOM XSS via static code analysis, how often do you find that you can exploit it?

1 2 0 0 0

Youssef A. Mohamed @GeneralEG64

7 years ago

DOM XSS at Cadillac (PoC) Video: youtu.be/OH1G5L1CHVI Closed as Informative Reason: The owner can't reproduce it. :3 #GeneralEG #BugsHunting

0 4 15 0 1

Hurricane Labs @hurricanelabs

7 years ago

Making Easy DOM XSS Actually Easy With Eval Villain - hurricanelabs.com/blog/making-ea… #firefox #web #extension #evalvillain #domxss

0 2 6 0 1

harisec @har1sec

7 years ago

@0x6D6172696F DOM XSS inside an iframe via postMessage (the iframe is included in the main page, but hidden). What is the impact in this case OR is there an impact in this case?

0 1 2 0 1

ØxＯＰＯＳɆＣ @OPOSEC

7 years ago

Coinbase AngularJS DOM XSS via Kiteworks. goo.gl/GSGgjX (+) #Security #178 (2017)

0 1 1 0 2

Andrew van der Stock @vanderaj

7 years ago

Learn DOM XSS if you don’t know it already. Follow @garethheyes

Gareth Heyes \u2028 @garethheyes

7 years ago

Learn DOM XSS if you don’t know it already. Follow @garethheyes

5 68 154 0 6

2 1 7 0 0

koto @kkotowicz

7 years ago

@fenceposterror And in general I don't think we are struggling with XSS because sanitization is hard. It's hard because the DOM APIs are insecure by default and in the end we end up with DOM XSS everywhere.

0 1 0 0 0

Haxel0rd @haxel0rd

7 years ago

Turning a DOM based #XSS into an attack to hack #XBOX online & live accounts. Microsoft has fixed it, so now releasing the #PoC vid that shows the #exploit in action. There was #NoBugBounty as MS has stopped BB's for online services. #hacking #ITSecurity youtube.com/watch?v=xfCUMH…