Category Archives: web

XSS CTF – How to execute payload inside an HTML comment (blacklisted words & encoded characters)

Posted on by

I’m trying to solve a CTF challenge that requires me to obtain the admin cookie through XSS. Here’s the situation:
-Main form: When I enter any input, it gets reflected in the page, but it is inserted inside an HTML comment. For example, i… Continue reading XSS CTF – How to execute payload inside an HTML comment (blacklisted words & encoded characters)→

Thousands of WordPress Websites Infected with Malware

Posted on by

The malware includes four separate backdoors:

Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed. A unique case we haven’t seen before. Which introduces another type of attack made possibly by abusing websites that don’t monitor 3rd party dependencies in the browser of their users.

The four backdoors:

The functions of the four backdoors are explained below:

  • Backdoor 1, which uploads and installs a fake plugin named “Ultra SEO Processor,” which is then used to execute attacker-issued commands
    …

Continue reading Thousands of WordPress Websites Infected with Malware→

Does letting a website use the fonts on my computer pose any security or privacy threat?

Posted on by

Does letting a website use the fonts on my computer post any security or privacy threat?
Example from https://acrobat.adobe.com/ accessed via Chrome on Windows 11:

acrobat.adobe.com wants to
Use the fonts on your computer so you can cre… Continue reading Does letting a website use the fonts on my computer pose any security or privacy threat?→