Hacking GTA V RP Servers Using Web Exploitation Techniques

Re:Hacking GTA V RP Servers Using Web Exploitation Techniques by mtlynch on Tuesday August 29, 2023 @09:44PM (#37316642)

>I know XSS is dying due to CORS

CORS isn't related to XSS. CORS actually isn't a security protection at all. It's a way for web apps to explicitly disable standard protections that browsers apply to enforce same origin policy.

You might be thinking of Content Security Policy (CSP).[0] That's the most effective protection I'm aware of for XSS, but it's not very widely used because so few JavaScript libraries are compatible with it.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

[ Parent | on HN ]

Re:Hacking GTA V RP Servers Using Web Exploitation Techniques by Jerrrry on Tuesday August 29, 2023 @11:03PM (#37317156)

yea, i meant CSP.

>so few JavaScript libraries are compatible with it.

is this because of the 'eval' function specifically, or is there other reasons?

[ Parent | on HN ]

Re:Hacking GTA V RP Servers Using Web Exploitation Techniques by mtlynch on Wednesday August 30, 2023 @07:09AM (#37320245)

Yeah, eval is the main culprit, but there's also Function, setTimeout, setInterval and friends.[0]

The other gotcha is that with a secure CSP policy, you can no longer do things like <button onclick="handleClick"> because that's inline JS, so that's kind of a bummer.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

[ Parent | on HN ]