Exploiting an RPO attack on Firefox | Filedescriptor solves Intigriti's XSS challenge

In this video Filedescriptor walks through how to solve Intigriti's May's XSS challenge with an RPO attack on Firefox.
Intigriti's XSS challenge: challenge.inti...
A few RPO exploitation techniques: www.mbsd.jp/Wh...
RPO Gadgets: blog.innerht.m...
Support us: www.buymeacoff...

[@TomNomNomDotCom]

Very well explained. Fantastic video, thank you :)

[@josephnimsara3169]

hey tomnomnom can you also video like this

[@zmbd-push-upskamunapaolulx9018]

I think he can, cuz I saw stok and him solving a XSS in hackerone

[@aaravclark3968]

I guess Im asking the wrong place but does anybody know a trick to log back into an instagram account..?
I stupidly forgot the account password. I appreciate any help you can give me!

[@daxeric9193]

@Aarav Clark Instablaster ;)

[@aaravclark3968]

@Dax Eric I really appreciate your reply. I found the site on google and im waiting for the hacking stuff now.
Seems to take a while so I will get back to you later when my account password hopefully is recovered.

[@bourbon3406]

Loved the video! Thanks. Expecting more great stuff.

[@domaincontroller]

00:17 CSS injection 00:26 Firefox only 00:48 source 00:54 sink, innerHTML 01:10 DOM XSS 01:22 widgets.js 03:06 open redirecter 05:07 relative path overwrite

[@payloadartist]

Thanks. Hard a hard time doing this challenge. Much clearer now.

[@PL-hk7dt]

Damn that was good, thank you, hope you will do more of these

[@zmbd-push-upskamunapaolulx9018]

Same

[@stackoverflow2155]

Holy cow!! This is so cool.

[@reda4632]

OMG , this so good , thanks for sharing

[@ichhasserosen664]

Fantastic! Thanks for the video!

[@jaibajpai6370]

Great explanation

[@bsysop]

Very nice video!.

[@netbin]

I am ONLY subscribing to this channel, because Stok recommend me to do so. I hope you not gonna fail it!

[@zmbd-push-upskamunapaolulx9018]

same

[@betterthanb4r]

These people are more talented than stok

[@neoXXquick]

amazing...

[@viralkingdom3711]

tnx bro we need more video tnx

[@sairam-lj6zu]

Great video. So all the websites which are using relative path is vulnerable ?
The //technique behaviour is specific to the challenge ?
Thanks

[@reconless]

The // is a misconfiguration on the server that results in open redirects. Here an example real-world case: hackerone.com/reports/52035.

[@nextlevel4189]

My favorite hacker ❤️

[@kab3800]

How can we redirect to a manually created webpage? do we have to use WAMP server for it? Eg. create an html page for redirection (evil.com) which will execute our XSS payload?

[@reconless]

You can abuse the // open-redirect vulnerability on the Intigriti challenge website. You have to chain that open redirect to achieve XSS.

[@gopikrishnac5958]

Hi, how can i access intigriti may month challenge??

[@reconless]

Intigriti will make an archive for past challenges. Right now unfortunately you can't :(

[@eldricksaw2]

Hi @filedescriptor, I've recently been scammed by online cryptocurrency exchange with a huge amount. The website seems to be from HK. Do you think you can help me? Singapore police force is not pursuing further investigation due to cryptocurrency being out of MAS jurisdiction. Please let me know, and would appreciate greatly any help you can provide. Thank you.