Upgrade to Pro — share decks privately, control downloads, hide ads and more …

2000day in Safari

F26c65b4ad90e281e3d866f466783201?s=47 Bo0oM
May 21, 2019
2
1.7k

2000day in Safari

F26c65b4ad90e281e3d866f466783201?s=128

Bo0oM

May 21, 2019
Tweet

More Decks by Bo0oM

See All by Bo0oM
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
31
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
2.2k
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
780
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
1
2.5k
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
3.6k
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
1.5k

Featured

See All Featured
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
67
4.5k
95d9f37115fbb0d13135d0f77132f856?s=48 morganepeng
99
15k
5f50f94346fbcb23706f0707169317a4?s=48 aarron
261
36k
1b75d89772b7eea1f6c89fbf362607d9?s=48 moore
129
22k
282d599b414022eba5096510f675b6e2?s=48 chrislema
231
16k
C0b42577cfc2b321be3474618107e933?s=48 samanthasiow
61
6.8k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
171
7.7k
C4de88ea47538e4594750e3861a341c8?s=48 brettharned
96
3.3k
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
58
3.8k
11c84dff30266b907714802088852677?s=48 jasonvnalue
87
8.4k
91cefdf141106fa10674aae74ce05890?s=48 yeseniaperezcruz
307
32k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
148
20k

Transcript

  1. 2000-day in Safari Anton Lopanitsyn @i_bo0om

  2. phdays.com #PHDays XSS https://portswigger.net/web-security/cross-site-scripting

  3. phdays.com #PHDays UXSS https://evil.com https://victim.com

  4. phdays.com #PHDays Save as webpage, complete

  5. phdays.com #PHDays chrome://flags

  6. phdays.com #PHDays MHTML

  7. phdays.com #PHDays MHTML

  8. phdays.com #PHDays

  9. phdays.com #PHDays Safari save as webarchive

  10. phdays.com #PHDays Signed webarchive

  11. phdays.com #PHDays Plaintext webarchive

  12. phdays.com #PHDays Plaintext webarchive <script> … </script>

  13. phdays.com #PHDays Plaintext webarchive

  14. phdays.com #PHDays

  15. phdays.com #PHDays https://blog.rapid7.com/2013/04/25/abusing-safaris-webarchive-file-format/

  16. phdays.com #PHDays

  17. phdays.com #PHDays

  18. phdays.com #PHDays

  19. phdays.com #PHDays

  20. phdays.com #PHDays

  21. phdays.com #PHDays xhtml

  22. phdays.com #PHDays xhtml

  23. phdays.com #PHDays file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Library/Mail%20 Downloads/2F4D2013-CCBF-4341-B05E-CEB4B76F30CE/Document.xhtm file:///Users/bo0om/Downloads/33h0ygug3ulny0gvwhh3d.webarchive

  24. phdays.com #PHDays

  25. phdays.com #PHDays file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Downloads/x.webarchive file:///Users/bo0om/Library/Containers/com.apple.mail/Downloads/x.webarchive file:///Users/bo0om/Library/Containers/Downloads/x.webarchive file:///Users/bo0om/Library/Downloads/x.webarchive file:///Users/bo0om/Downloads/x.webarchive

  26. phdays.com #PHDays DEMO https://github.com/Bo0oM/Safari2000day)

  27. Thank you!