cure53

The Scriptless Scriptlet

Or how to execute JavaScript from CSS in MSIE11 without using Scripts

Stop! This text is only interesting for you if you...

• Like popping alerts in weird situations
• Miss CSS expressions as much as we do
• Have an unhealthy obsession for markup porn

Introduction

cure53

Calling alert from WebAssembly (WASM)

This very simple and minimal tutorial documents in a few easy steps how to play with WebAssembly (WASM) and get first results within minutes.

While the code below is mostly useless, it will show, how to call the alert function from within a WASM file and thus demonstrate how to import and export DOM objects.

Of course, this exercise has no real use. It is just meant to show, that getting started with WASM isn't hard. And there is no need for a complex build-chain, tons of tools or a dedicated VMs. Just use a browser, one online tool and that's it.

And Now?

cure53

WordPress Flash XSS in flashmediaelement.swf

1. Intro
2. Background
3. Affected Systems
4. Mitigation

Quick Overview

cure53

WordPress SOME bug in plupload.flash.swf

1. Intro
2. Background
3. Affected Systems
4. Mitigation

Quick Overview

cure53

OTF+SVG allows to read info character by character with only a STYLE injection through XEE & timing

Intro

Mozilla Firefox supports a feature that allows to define SVG images inside an OTF font to represent characters. This is useful if we for example want to work with colorful characters, Emoji, animated characters and so on. Firefox is currently the only relevant browser supporting this technology.

The general technology and its advantages are described here:

• https://hacks.mozilla.org/2014/10/svg-colors-in-opentype-fonts/

cure53

<?php

    /**
     * XSS protection function for HTML context only
     * @usecases
     * <title>use this function if output reflects here or as a content of any HTML tag.</title>
     * e.g.,  <span>use this function if output reflects here</span>
     * e.g., <div>use this function if output reflects here</div>
     * @description
     * Sanitize/Filter < and > so that attacker can not leverage them for JavaScript execution.

cure53

Keybase proof

I hereby claim:

• I am cure53 on github.
• I am cure53 (https://keybase.io/cure53) on keybase.
• I have a public key whose fingerprint is F98B 0EC1 8640 2F60 292C 5877 C26C 8580 90F7 0ADA

To claim this, I am signing this object: