Soyjak Wiki / Soyjakwiki.org

[soyoyuki]

https://soyjakwiki.org/Special:Contributions/Angeleno
noob came back from the dead

interesting
https://soyjakwiki.org/index.php?title=P0rt42&diff=prev&oldid=571355

 

[X3D3XD]

interesting
https://soyjakwiki.org/index.php?title=P0rt42&diff=prev&oldid=571355

I was surprised aswell

 

[soyoyuki]

Now for the vulnerabilities. The one I was sent (1) and the ones OpenAI's daybreak found (2) were three different XSS vulnerabilities in the software. ALL of them require some amount of social engineering to pull off, and all of these vulnerabilities including the one that breached shemmy worked in around the same way, they would (or could) run a JavaScript payload to create a new user make it admin, and set a password, allowing an attacker to gain access to the website that way (<svg onload=...>). I mentioned social engineering, because they all require a mod/admin to click on a specific link or fill in something with code, or get a user to socially engineer themself into a moderator status.
But this isn't how the shemmy got breached....

The shemmy had some extra modifications in there, some things that displayed user fields with absolutely NO sanitization. So you wouldn't even need a mod or admin to click on anything. THAT's how you get breached. Something similar was added during the kuz era of soyjak.party.

oopsies so in the end devloper fucked it all up? keeeeeeeeeeeeeeeekk

 

[soyoyuki]

Now for the vulnerabilities. The one I was sent (1) and the ones OpenAI's daybreak found (2) were three different XSS vulnerabilities in the software. ALL of them require some amount of social engineering to pull off, and all of these vulnerabilities including the one that breached shemmy worked in around the same way, they would (or could) run a JavaScript payload to create a new user make it admin, and set a password, allowing an attacker to gain access to the website that way (<svg onload=...>). I mentioned social engineering, because they all require a mod/admin to click on a specific link or fill in something with code, or get a user to socially engineer themself into a moderator status.
But this isn't how the shemmy got breached....

The shemmy had some extra modifications in there, some things that displayed user fields with absolutely NO sanitization. So you wouldn't even need a mod or admin to click on anything. THAT's how you get breached. Something similar was added during the kuz era of soyjak.party.

oopsies so in the end devloper fucked it all up? keeeeeeeeeeeeeeeekk

so the swinny & chinny threats were totally fake meaning that they never had to switch to jschan...

 

[Idkchud]

so the swinny & chinny threats were totally fake meaning that they never had to switch to jschan...

I'm still glad they did anyways fuck vichan

 

[Apeson]

so the swinny & chinny threats were totally fake meaning that they never had to switch to jschan...

It would explain why the shemmy was targeted first. It was a bluff.

 

[lampsonlighter]

so the swinny & chinny threats were totally fake meaning that they never had to switch to jschan...

Pretty sure the Chinny still uses vichan