4 ms·
Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?
by MajesticHobo2 10mo ago
Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?
- rvnx 10mo agoSeems like none of these major websites detected anything, and they are supposed to be top-notch in the world. It's only because the researcher contacted them.
- tptacek 10mo agoAlso because nobody actively exploited them! You're using the word "detected" to mean "discovered", which nobody working in the field would ever do.
- rvnx 10mo agodetected: WAF caught or detected the attack and raised an alert, post-exploitation discovered: they audited or pentested themself and found out, preemptively I just mean that Coinbase didn’t see anything happening and didn’t take action though the boy successfully exploited the vulnerability on their live system.
- deleted 10mo ago[deleted]