- writeups on web security and whatever i'm currently breaking.
Two packages, one signature2026-07
Intigriti's July 2026 challenge. A duplicate JSON key makes the authorizer and the report renderer disagree about which package a signed manifest refers to, and the signature stays valid for both.
#ctf#access-control#json#parser-differential· 9 min
PostMessage XSS-н тухай2024-05
Same-Origin Policy, iframe/window хоорондын харилцаа, postMessage-ээр ирсэн мессежийг sanitize хийлгүй DOM-руу бичихэд үүсэх XSS. PoC болон бодит report-уудтай.
#xss#postmessage#sop· 5 min