Latest blog posts

Exploiting blind XSS to steal the cookie of the admin with CDN Content Security Policy (CSP) bypass.

Investigating a suspicious Word document to figure out what malicious VBA macros are run.

In this blog post, I am going to walk through Intigriti’s May 2022 XSS challenge. I will explain how prototype pollution can be used to bypass a client-side HTML sanitizer to get XSS.

A HackTheBox web challenge where we need to exploit insecure file extraction and XSS to gain remote code execution (RCE) on the webserver.

In this blog post, I am going to walk through Intigriti’s September XSS challenge by @BugEmir and Pepijn van der Stap. I will explain how I approached and solved this challenge.