Conversation

Notices

1. Embed this notice
   nekobit (nekofag@rdrama.cc)'s status on Friday, 26-May-2023 12:06:38 JST nekobit
   Okay okay, Graf's advice is outdated, it turns out that the code for it is now *obfuscated*.
   
   I found this .js file uploaded to my server under the filename `pfp.js`. It's NOT the same hash, you are still vulnerable. It is being exploited, clearly.
   
   https://paste.sqt.wtf/707d32
   
   If you run a Ctrl+F, the fedirelay.xyz url is there, so the hash check method is completely retarded, but it may be done to work around the hash files.
   
   Fuck I'm probably leaked too but I don't really give a damn.
   • Embed this notice
     :ihavenomouth: (inginsub@clubcyberia.co)'s status on Friday, 26-May-2023 12:46:39 JST :ihavenomouth:

     in reply to
     @nekofag have you figured out how pleroma runs the js code? Does it just fucking embed the attachment contents?
     Fediverse Contractor likes this.