3 ms·
Why would YOU see a mystery XSS exploit on a social network? The idea of the DoD scoring these little exploits in a box is usually to deploy in a highly control
by vablings 10mo ago
Why would YOU see a mystery XSS exploit on a social network? The idea of the DoD scoring these little exploits in a box is usually to deploy in a highly controlled and specific manner. You as a layperson is of no interest to them unless you are some kind of intelligence asset or foreign adversary
- MajesticHobo2 10mo agoWouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?
- rvnx 10mo agoSeems like none of these major websites detected anything, and they are supposed to be top-notch in the world. It's only because the researcher contacted them.
- tptacek 10mo agoAlso because nobody actively exploited them! You're using the word "detected" to mean "discovered", which nobody working in the field would ever do.
- rvnx 10mo agodetected: WAF caught or detected the attack and raised an alert, post-exploitation discovered: they audited or pentested themself and found out, preemptively I just mean that Coinbase didn’t see anything happening and didn’t take action though the boy successfully exploited the vulnerability on their live system.
- deleted 10mo ago[deleted]