[Globules]

https://sensepost.com/blog/2023/dress-co.../#jsdelivr
We can bypass it

[xxxbfacc]

Access to dashboard with stolen cookie from webdev adam.
Can't crack his hash, and don't see anything exploitable in the /report /delete /resolve /backup or /change_priority endpoints yet.
Anyone have anything?

[ox9Days]

Access to dashboard with stolen cookie from webdev adam.
Can't crack his hash, and don't see anything exploitable in the /report /delete /resolve /backup or /change_priority endpoints yet.
Anyone have anything?

how did you get that webdev adam cookie?

[asdfmonster]

What method to obtain cookie?

[Globules]

Access to dashboard with stolen cookie from webdev adam.
Can't crack his hash, and don't see anything exploitable in the /report /delete /resolve /backup or /change_priority endpoints yet.
Anyone have anything?

how did you get that webdev adam cookie?

Probably via a xss bypassing jsdelivr in report

[xxxbfacc]

cookie from report_bugs via img tag xss

[osamy7593]

plz bro what payload u used

cookie from report_bugs via img tag xss

[asdfmonster]

did you do a http server type payload?

[osamy7593]

what after xss .........................................

[willow]

I'm also very curious what the approach is with the XSS here. I feel like I've tried every XSS payload under the sun at this point.