Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/ryanc/statuses/113716288616785113">Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Thursday, 26-Dec-2024 09:27:42 JST</a><a href="https://infosec.exchange/@ryanc" title="ryanc@infosec.exchange"><img src="https://gnusocial.jp/avatar/174285-48-20231204225121.webp" width="48" height="48" alt="Ryan Castellucci :nonbinary_flag:" style="position: absolute; left: 0; top: 0;">Ryan Castellucci :nonbinary_flag:</a><div><a href="https://mastodon.social/@cyclophora/113716239459534920" rel="in-reply-to">in reply to</a><ul><li></ul></div></section><article><p><a href="https://mastodon.social/@cyclophora" rel="nofollow noreferrer">@cyclophora</a> Did you know that settimeout can take a string argument?</p><p>You can add an invisible button to the dom with an onclick attribute that's a string of code and then call .click() on it.</p><p>Create an iframe with a javascript:... URI.</p><p>It's a bit of a lost cause.</p><p>Also, I've written bytecode interpreters in JavaScript that can run arbitrary code and bypass CSP restrictions.</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4255906#notice-8317994">In conversation</a><time datetime="2024-12-26T09:27:42+09:00" title="Thursday, 26-Dec-2024 09:27:42 JST">about 23 days ago</time> <span>from <span><a href="https://infosec.exchange/@ryanc/113716288616785113" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@ryanc/113716288616785113">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: www.uri.it</div><h5><a href="https://www.uri.it/">URI Homepage - Uri</a></h5><div> from <span>admin</span></div></header><div>URI SpA - Your working partner: scopri la nostra proposta per i lavori di ingegneria civile e la perforazione</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Thursday, 26-Dec-2024 09:27:42 JSTRyan Castellucci :nonbinary_flag:
in reply to
- Cyclophoratrice
@cyclophora Did you know that settimeout can take a string argument?
You can add an invisible button to the dom with an onclick attribute that's a string of code and then call .click() on it.
Create an iframe with a javascript:... URI.
It's a bit of a lost cause.
Also, I've written bytecode interpreters in JavaScript that can run arbitrary code and bypass CSP restrictions.
In conversationabout 23 days ago from infosec.exchangepermalink
Attachments
1. Domain not in remote thumbnail source whitelist: www.uri.it
  URI Homepage - Uri
  from admin
  URI SpA - Your working partner: scopri la nostra proposta per i lavori di ingegneria civile e la perforazione

Public

Embed Notice

HTML Code

Corresponding Notice