3 ms·
Simple example that this isn't true: an admin portal that shows requests and doesn't escape properly. Bam, you just broke their whole backoffice.
by MichaelGG 11y ago
Simple example that this isn't true: an admin portal that shows requests and doesn't escape properly. Bam, you just broke their whole backoffice.
- tptacek 11y agoSimple refxss testing can easily fuck sites up; all the site has to do is stash a query input somewhere that gets rendered back out in JS to all users later (extremely common example: search results). All the sudden every user on the site is getting alert popups. A lot of these sites can calculate down to the second and the dollar how much they lose if their site goes down. Guess who's liable if the cause of that downtime is you?