Generic HTML Sanitizer Bypass Investigation
6,597I stumbled over a weird HTML behavior on Twitter and started to investigate it. Did I just stumble over a generic HTML Sanitizer bypass?
Get my handwritten font https://shop.liveoverflow.com (advertisement)
Checkout our courses on https://hextree.io (advertisement)
The Tweet: https://twitter.com/MRCodedBrain/status/1662701541680136195
Google XSS: https://www.youtube.com/watch?v=lG7U3fuNw3A
HTML Spec: https://html.spec.whatwg.org/multipage/parsing.html#parse-error-invalid-first-character-of-tag-name
Chapters:
00:00 - Intro
01:09 - Sanitizing vs. Encoding
02:32 - Developing HTML Sanitizer Bypass
05:03 - Attacking DOMPurify
07:08 - Attacking Server-side Sanitizer
08:31 - HTML Parse Error Specification
10:08 - Potential Impact
11:55 - hextree.io
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ 🐕 Social ]=
→ Twitter: https://twitter.com/LiveOverflow/
→ Streaming: https://twitch.tvLiveOverflow/
→ TikTok: https://www.tiktok.com/@liveoverflow_
→ Instagram: https://instagram.com/LiveOverflow/
→ Blog: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/
Other Videos By LiveOverflow
| 2023-12-21 | A Vulnerability to Hack The World - CVE-2023-4863 |
| 2023-11-20 | Reinventing Web Security |
| 2023-10-17 | The Circle of Unfixable Security Issues |
| 2023-10-05 | Binary Exploitation vs. Web Security |
| 2023-09-19 | Hacker Tweets Explained |
| 2023-08-29 | Zenbleed (CVE-2023-20593) |
| 2023-08-18 | The Discovery of Zenbleed ft. Tavis Ormandy |
| 2023-08-01 | Asking Android Developers About Security at Droidcon Berlin |
| 2023-07-22 | Local Root Exploit in HospitalRun Software |
| 2023-07-13 | Android App Bug Bounty Secrets |
| 2023-07-03 | Generic HTML Sanitizer Bypass Investigation |
| 2023-06-22 | Hacking Google Cloud? |
| 2023-06-11 | Trying to Find a Bug in WordPress |
| 2023-05-31 | Authentication Bypass Using Root Array |
| 2023-05-22 | My YouTube Financials - The Future of LiveOverflow |
| 2023-05-11 | Defending LLM - Prompt Injection |
| 2023-04-27 | Accidental LLM Backdoor - Prompt Tricks |
| 2023-04-14 | Attacking LLM - Prompt Injection |
| 2023-04-01 | Our Future As Hackers Is At Stake! |
| 2023-03-29 | Cyber Security Challenge Germany (2023) |
| 2023-03-20 | Cybercrime is Not Hacking! |