Stealing Financial Data on Logout: A DOM XSS Story
A logout redirect validated the hostname and ignored the scheme. One encoded newline turned it into same-origin DOM XSS that waited for login and read loan and bank data.
Posts
Escaping VS Code Webviews: The return of the path traversal
How an encoded slash bypassed VS Code’s Webview resource allowlist and turned a sandboxed view into an arbitrary file reader.
How to Freeze a Blockchain with 320 Valid Blocks
How misplaced rate limits let one validator freeze a blockchain with 320 valid blocks and no transaction fees.
How a grocery app's photo upload became a one-tap account takeover
I tried to hide code in a picture. A few dead-ends later, one ordinary HTTPS link ran my JavaScript inside any user’s logged-in app. No password, one tap.