Top all-time · #3882
Securitum. Leading european penetration testing company
Company blog · research.securitum.comsecurityprogramming
Securitum. Leading european penetration testing company is the company blog at research.securitum.com, writing about security and programming. Since 2019, 19 different Hacker News readers have linked it 27 times, most often “Chrome canary and same origin bypass with 10k bounty research”. No feed was found, so read it on the site itself.
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European
Most-linked posts?
- Chrome canary and same origin bypass with 10k bounty research5 people · 7 mentions · first linked 2019-09-05
- DOMPurify bypass: XSS via HTML namespace confusion4 people · 5 mentions · first linked 2020-10-06
- Fail2ban – Remote Code Execution3 people · 3 mentions · first linked 2021-09-25
- Exploiting prototype pollution2 people · 3 mentions · first linked 2019-11-21
- The Curious Case of Copy and Paste2 people · 2 mentions · first linked 2020-06-15
- XSS in Gmail’s AMP4Email via DOM Clobbering2 people · 2 mentions · first linked 2019-11-19
What Hacker News says?
Yes, because it is worth in pentesting services 180k USD, no more no less. I mean, you can pay around 360k in London or SV rates and 180k in European for _similar_ skills people. Calc based on 3 months, 5 people, 600USD/md rate. EDIT as I can't reply to tpaceck below: no, those 2000usd/day rates do not exists in projects in size of 300MD like here. In general they do not exist for big projects. Yes, I agree, you hav…
Comment linking /mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/
on “We Hacked Apple for 3 Months”Submitted Fail2ban – Remote Code Execution as a story · 169 points
HN discussionThe latter point? Yeah, there's a few things I can point to: - PNaCl, which was essentially Chrome's ActiveX. Thankfully going away in the near future, after nobody else implemented it. See https://www.cnet.com/news/mozilla-coder-chrome-violates-goog... - The severe limits applied to the webRequest extension API, breaking extensions such as uBlock Origin, without cross-browser consensus: https://blog.mozilla.org/add…
Comment linking /security-analysis-of-portal-element/
on “Inkscape 1.0 Beta 1”Submitted DOMPurify bypass: XSS via HTML namespace confusion as a story · 161 points
HN discussion<portal> is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged. It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a w…
Comment linking /security-analysis-of-portal-element/
on “Twitter is using its embedded JavaScript to hide tweets that have been deleted”Submitted The Curious Case of Copy and Paste as a story · 61 points
HN discussionBecause DOMPurify is not perfect. Due to some problem of HTML parsing, there were some ways to bypass it: https://research.securitum.com/mutation-xss-via-mathml-mutat... Having a builtin XSS sanatizer means it could always use a single parser to prevent such bypass.
Comment linking /mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/
on “Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse”Submitted Exploiting prototype pollution as a story · 53 points
HN discussionYou know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-executio... . It’s adding extra attack surface for a cosmetic benefit.
Comment linking /fail2ban-remote-code-execution/
on “AS13335 doing SSH scanning”Submitted CSS data exfiltration in Firefox via a single injection point as a story · 19 points
HN discussionHTML5 rules didn't solve the problem of parsing HTML files into a DOM. Instead it mandated the existence of HTML files which, when parsed, converted to HTML, and parsed again, produce a different tree than the first time around. This harmful property can be used to develop XSS exploits like https://research.securitum.com/mutation-xss-via-mathml-mutat... .
Comment linking /mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/
on “The harmful consequences of the robustness principle”Submitted Chrome canary and same origin bypass with 10k bounty research as a story · 3 points
HN discussionMy favorite example of the technical failings of HTML: https://research.securitum.com/mutation-xss-via-mathml-mutat... is a HTML sanitizing vulnerability that came about because some HTML not only doesn't survive a parse-stringify cycle, but the generated DOM tree does not survive a stringify-parse cycle !
Comment linking /mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/
on “Fixed-Point HTML”Submitted Comparison Of Reverse Image Searching In Popular Search Engines as a story · 2 points
HN discussionYou can do more than individual characters, you can use ligatures to adjust combinations of characters https://research.securitum.com/stealing-data-in-great-style-...
Comment linking /stealing-data-in-great-style-how-to-use-css-to-attack-web-application/
on “Targetting specific characters with CSS rules”Submitted On Risks Of Pasting Arbitrary Content In Browsers as a story · 2 points
HN discussionThis article is not very good in convincing that prototype pollution is a problem. There was a write up about the kibana rce that really shows it's a problem: https://research.securitum.com/prototype-pollution-rce-kiban...
Comment linking /prototype-pollution-rce-kibana-cve-2019-7609/
on “Prototype Pollution (2020)”Submitted Write-up of DOMPurify 2.0.0 bypass using mutation XSS as a story · 2 points
HN discussionI had to look up what prototype pollution is. This post has a good explanation [1]. The attacker construct an object on your server which contains an own-property '__proto__'. This is straightforward to do if you decode user-supplied JSON (e.g. a REST API) but this alone is not a vulnerability. The vulnerability occurs when you iterate over this object's own-properties and use the resulting keys on another object. I…
Comment linking /prototype-pollution-and-bypassing-client-side-html-sanitizers/
on “Computer scientist identifies JavaScript vulnerability in thousands of websites”Submitted Security Analysis of Chrome Portal HTML Element as a story · 2 points
HN discussionRemember when fail2ban had an RCE to execute things on a server via root user and it was as simple as parsing an email string because it was executing the mail binary on the other end? [1] That's pretty much the reason why I started to write my own guard tools. I don't need people from China or Russia logging in to my server. I don't understand why tools like this are never built in an ASN aware manner, blocking mec…
Comment linking /fail2ban-remote-code-execution/
on “SSHGuard”Submitted Security Analysis of Portal HTML Element as a story · 2 points
HN discussionSubmitted Exploiting prototype pollution – RCE in Kibana (2019) as a story · 1 points
HN discussionSubmitted XSS in Gmail’s AMP4Email via DOM Clobbering as a story · 1 points
HN discussionSubmitted XSS in GMail’s AMP4Email via DOM Clobbering as a story · 1 points
HN discussionSubmitted Chrome same-origin bypass using the portal element as a story · 1 points
HN discussionSubmitted Chrome same-origin bypass using the element as a story · 1 points
HN discussion
