Kimberly
- Linktree
- https://linktr.ee/kimmy.zip
- https://www.instagram.com/kimmydotzip
- Mastodon
- https://hackers.town/@kimmy
Product Manager | InfoSec | Trans 🏳️⚧️ | Polyam 💞 | She/her | Taller than you
Joined Oct 2022
Lol I had to change the i's to 1's in the word "script." I blame @th3j35t3r.
Even more fun, when they "blocked scripts" they only removed "<scr1pt>" in a single pass, so I injected "<scr<scr1pt>ipt>" and chaos ensued.
Then they switched to ColdFusion's native XSS protection, so I used "<body onload.." and yay more XSS.
Good times. Now I'm a PM.
Random story....
One of my favorite low-effort hacks was when I used a type2 XSS injection of <marquee> into a work ticket so the appdev team had to chase the entire ticket across the screen to get to the close button.
The devs said "How? We blocked scripts!"
They say we're the problem.
They pass laws to hurt us.
They say we should die.
They make a list of names.
They make us wear a badge.
They put us in camps.
The—rest is history.
https://www.rollingstone.com/politics/politics-news/ken-paxton-list-trans-texans-1234647489/
Kimberly
boosted
Kimberly
- Linktree
- https://linktr.ee/kimmy.zip
- https://www.instagram.com/kimmydotzip
- Mastodon
- https://hackers.town/@kimmy
Product Manager | InfoSec | Trans 🏳️⚧️ | Polyam 💞 | She/her | Taller than you
Joined Oct 2022