4 ms·
The author is aware. > Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it
by hiatus 3y ago
The author is aware.
> Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the page.
https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...
- gregsadetsky 3y agofor sure, there's awareness and then there's disregard of any basic web security. the second they start hosting any application/backend/cookie-enabled thing on this domain name, anyone could inject a script via their /post/ gzip-base64 scheme, and do bad things...? I don't think html sanitization would go against the principle of this idea. just... at the very least strip the tags! :-)
- hk__2 3y ago> The author is aware. Since the website is vulnerable to XSS, you could inject a script that removes the disclaimer.
- gregsadetsky 3y ago100%. poc: https://joshcsimmons.com/post/eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc%2FPLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg%3D https://joshcsimmons.com/post/eNqzKU4uyiwosUvJTy7NTc0r0UtPLX...
- cengizIO 3y agoVery clever. For those wondering, this won't gunzip since it's compressed using zlib. you must do a chain like this: URL Decode -> Base64 Decode -> Zlib Inflate.
- gregsadetsky 3y agoright on! I used https://bugdays.com/gzip-base64 https://bugdays.com/gzip-base64 to go back and forth. base64 generates slashes, so the site (and I) run encodeURIComponent in the devtools on the resulting base64 to make sure it's completely url-safe. --- the poc "payload" is eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc%2FPLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg%3D which uri-component-decodes to: eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc/PLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg= which un-base64+gzip's to (using the site I posted above): <script>document.getElementsByClassName('light')[0].remove()</script> # this is bad
- joshcsimmons 3y agoHah this is clever. Mixed feelings on patching this but I patched it for now.
- pwdisswordfishc 3y agos/removes the disclaimer/exploits a browser 0-day/
- Dylan16807 3y agoThere are much less weird links you can give someone if you have 0-day. I don't think that's a problem worth worrying about for the author.