prsecurity
Re:Show HN: Web pages stored entirely in the URL
on Monday July 01, 2019 @11:37PM (#20331935)
You still need something to serve you the initial document.write js, unless you are going to convince people to open your links with locally saved "index.html". I called it "XSS" because you can execute arbitrary javascript, and I was trying to avoid bluntly calling it "malware".
Though I probably should have. Here is an example of a HackerNews login page served with jstrieb.github.com https://tinyurl.com/yypvh3by, you can login to news.ycombinator.com with it, but it easily could have been a phishing site.
My point is, this is a very good idea for offensive operations.
Re:Show HN: Web pages stored entirely in the URL
on Sunday June 30, 2019 @06:17PM (#20320914)
You are abusing trust - now it's going to be the jstrieb.github.io who is serving malware, and since his system serves whatever JS I provide by design it becomes a very effective XSS host.
Re:U.S. Carried Out Cyberattacks on Iran
on Sunday June 23, 2019 @12:27PM (#20256628)
according to people briefed on the operation.
The article smells of Soviet propaganda machine by claiming to conduct a successful offensive yet providing no way of verifying even the very fact it happened.