chloe @dotchloe

Security Engineer Sweden Joined November 2014

Tweets

705
Followers

709
Following

142
Likes

526

chloe @dotchloe

9 months ago

@terjanq When are you planning to publish the package? Would like to do some testing :)

0 0 0 28 0

View Details

chloe @dotchloe

9 months ago

@Rhynorater @garethheyes Meh, it will take 5 years until you'll actually see this in a product :D

0 0 0 36 0

View Details

chloe @dotchloe

9 months ago

@ycombinator @SellRaze @JeffMao_ @TylerMa_ lol, I built an app for this like a year ago for personal use, even an agent that can answer questions and remove other listing once sold

1 0 0 80 0

View Details

chloe @dotchloe

2 years ago

@TomNomNom Are you coming to Stockholm? :)

1 0 1 58 0

View Details

chloe @dotchloe

2 years ago

@joaxcar iframe also has a "csp" attribute developer.mozilla.org/en-US/docs/Web…

1 0 1 68 0

View Details

chloe @dotchloe

2 years ago

@cure53berlin @IcesFont What's the reason you didn't assigned a CVE for this?

0 0 0 119 0

View Details

chloe @dotchloe

2 years ago

@TomNomNom I like that there's XSS

0 0 1 136 0

View Details

chloe @dotchloe

2 years ago

@renniepak 1% man

0 0 0 90 0

View Details

chloe @dotchloe

2 years ago

@garethheyes @YNizry @garethheyes See: portswigger-labs.net/xss/xss.php?x=… - needs <script> tag

1 0 1 112 1

View Details

chloe @dotchloe

3 years ago

@troyhunt @capellisport @Scott_Helme @milkyjoseph Try your luck over at community.disclose.io/c/hacker-conne… cc @caseyjohnellis

0 0 1 101 0

View Details

chloe @dotchloe

3 years ago

@DrReinhold @bramus @sw12 Of course, the hash is never sent to the server.

1 0 1 21 0

View Details

chloe @dotchloe

3 years ago

@Agarri_FR That's fine as tweets about CVE's are often just reposted content.

0 0 0 62 0

View Details

chloe @dotchloe

3 years ago

@we1x Allowing CDN's, unsafe-inline and self in style-src would still mitigate this attack?

1 0 0 71 0

View Details

@LiveOverflow Back in 2014 this was more considered a best practice. Today, a requirement. But there's no impact, so no bounty. Also, would've focused mostly on setting up a RDP than fixing the issue.

1 0 0 232 0

View Details

chloe @dotchloe

3 years ago

@renniepak Vitamin D, light therapy and looking forward to skiing is the key :)

0 0 0 94 0

View Details

chloe @dotchloe

3 years ago

@win3zz Result of sec research could later lead to bug hunting.

0 0 1 134 0

View Details

chloe @dotchloe

3 years ago

@garethheyes wait, it was never named "HackVector"?!? This is the mandela effect in play

0 0 1 200 0

View Details

chloe @dotchloe

3 years ago

@ITSecurityguard Definitely not snakeoil. Just an alternative way of learning.

0 0 1 319 0

View Details

chloe @dotchloe

3 years ago

@roohaa_n @Bugcrowd This is indeed bad. Before a company launch a program, they should CLEAR the backlog! 100$ for a P1 should make you instantly stop hacking on that program.

0 0 0 73 0

View Details

chloe @dotchloe

3 years ago

@7odamoo Can you provide more info? Can you control a href value in an A tag? If so, '\t', '\n' and '\r' are allowed to be after "javascript" and ":" - so "javascript\n:" is valid in Chrome.