A cool recon trick to find more targets is to check out CSP policies for juicy assets.

csprecon can do this for you 👉 https://github.com/edoardottt/csprecon

I made a tool to help test archive (zip/tar) extraction bugs (sync working directory into archive, add path traversals, links, permissions, etc): github.com/avlidienbrun...

Added a keyboard shortcut on the MXSS. I still find this tool useful when messing around with HTML.

portswigger-labs.net/mxss/

A younger me, as a pentester and bug hunter, had exactly the bias described in this article 🤫

Luckily, I later worked with and for "the other side" and it changed my mind 🤯

I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞

Finally taking the last steps to "remove" my Twitter account. As I don't want to get impersonated, I will just empty it out and leave it to die slowly. Is there any other way?

Must admit my timeline here is not as interesting, but I guess that's up to me to fix.

Want to know what the 'Top 5 security mistakes software developers make' are? Read this article by David Strom, that quotes me several times, to learn more!

www.csoonline.com/ar...

Yesterday I discovered a tweet of mine was referenced in the book "Attacking and Exploiting Modern Web Applications: Discover the mindset, techniques, and tools to perform modern web attacks and exploitation"

www.amazon.nl/-/en/Simone-...

Since I deleted my account, this is the tweet:

I'm fall in love with Js it's like I can't even passed a day without it

When coaching junior programmers I would often suggest this:

Got a problem? Not sure the right direction? Try anything at all! Worst case is you'll learn something, best case is you make something good.

Also: it's practice, so you get faster at trying new things, so you get faster at everything.

Watch my video to learn about chapter 2 of Alice and Bob Learn Secure Coding: youtu.be/7A09EEpngxI...

Get the book here:
shehackspurple.ca/bo...

Contents of Chapter 2: Beginning
· Follow a Secure System Development Life Cycle (Part 3)

Handling Cookies is a Minefield:

Inconsistencies in the HTTP cookie specification and its implementations have caused a situation where countless websites (including Facebook, Netflix, Okta, WhatsApp, Apple, etc.) are one small mistake away from locking their users out.

grayduck.mn/2024/11/21/h...

Got sniped into the challenge and ended up doing some cool XSS research :D

11 char XSS with mind-boggling race-conditions.

TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char)

It's shorter than location=name !!

terjanq.me/solutions/jo...

A small code-golf web challenge (free research from you, for me), how short can you make a "fetch content and execute it inline".

There is a CSP in a meta tag.
Goal: get the content from the file hack.js and have it inserted in the page. like in the image

joaxcar.com/xss/self.html