prsecurity

14 ms·

1. 1.▲
   by prsecurity 7y ago

   You still need something to serve you the initial document.write js, unless you are going to convince people to open your links with locally saved "index.html". I called it "XSS" because you can execute arbitrary javascr
2. 2.▲
   by prsecurity 7y ago

   You are abusing trust - now it's going to be the jstrieb.github.io who is serving malware, and since his system serves whatever JS I provide by design it becomes a very effective XSS host.
3. 3.▲
   by prsecurity 7y ago

   according to people briefed on the operation. The article smells of Soviet propaganda machine by claiming to conduct a successful offensive yet providing no way of verifying even the very fact it happened.