Two live exploits. Two attack chains.
One talk: Opportunities & Challenges.
Exploit insecure direct object references to read another user's PII, extract their password hash, and take over their account — all through URL manipulation.
BROKEN ACCESS CONTROLInject a malicious script into the company feed, steal a victim's session cookie, and hijack their account — with a payload invisible to the naked eye.
CROSS-SITE SCRIPTING