anton

Sorry! 😅

This is pain to look at :')

I kinda get it if it requires additional development for the vendor to implement but it's kinda shitty if using standard stuff like okta or gsuite. Have found some fun findings in pentests where you're able to implement your own SSO though, like - if you control the SSO you can be whoever you want

Älmhult då!? 😅

I think this works best for developers who are familiar to understand when something's odd and worth investigating. Thoughts?

i get your point :) still, building tools usually gets you deep into how stuff actually works

That's not true :) and your csp bypass tool is really really really awesome

I actually think I know now, //example.com/<yolo> gets urlencoded since it's now part of the path.. and any value that get's parsed as an URL gets encoded. Or not? new URL("//yolo.com/") is rejected

@joaxcar.bsky.social i cheated :')

@joaxcar.bsky.social okay so href parses any valid url, and that's why it chops it off after // or http(s)://? I'm not really sure although why anchor.href = "//example.com<style onload=alert(1)>" works but not anchor.href = "//example.com/<style onload=alert(1)>"?