Follow
Random story....
One of my favorite low-effort hacks was when I used a type2 XSS injection of <marquee> into a work ticket so the appdev team had to chase the entire ticket across the screen to get to the close button.
The devs said "How? We blocked scripts!"
Lol I had to change the i's to 1's in the word "script." I blame @th3j35t3r.
@kimmy
Cold Fusion... now that is a name I haven't seen in a long time
@Beerdini don't say it a third time or it will come back!
@kimmy
Nah... it was bought by Adobe, like so many other decent programs before they get worse and die
Even more fun, when they "blocked scripts" they only removed "<scr1pt>" in a single pass, so I injected "<scr<scr1pt>ipt>" and chaos ensued.
Then they switched to ColdFusion's native XSS protection, so I used "<body onload.." and yay more XSS.
Good times. Now I'm a PM.