Hackers' Pub

Syntax	Description	Examples
`"` keyword `"`	Finds the string within quotes, including spaces. Case-insensitive. (Escape quotes inside with `\"`)	`"Hackers' Pub"`
`from:` handle	Finds content written by the specified user.	`from:hongminhee` `from:hongminhee@hollo.social`
`lang:` ISO 639-1	Finds content written in the specified language.	`lang:en`
`#` tag	Finds content with the specified tag. Case-insensitive.	`#HackersPub`
condition condition	Finds content that satisfies both conditions on either side of the space (logical AND).	`"Hackers' Pub" lang:en`
condition `OR` condition	Finds content that satisfies at least one of the conditions on either side of the OR operator (logical OR).	`#HackersPub OR "Hackers' Pub" lang:en`
`(` condition `)`	Combines the operators within the parentheses first.	`(#HackersPub OR "Hackers' Pub" OR "Hackers Pub") lang:en`

daniel:// stenberg:// @bagder@mastodon.social

11/21/2025, 1:41:33 PM

Public

One of the mysteries of the world. People sending made up reports about a service on a URL that doesn't exist...

Hello,

Stored XSS can be submitted on reports, and anyone who will check the report the XSS will trigger.

Description:
Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs
when a malicious script is injected directly into a vulnerable web application.

Steps To Reproduce:
1- Go to https://app.curl.se/reports/custom/
2- Click New network report.
3- On the name, enter payload: "><img src=x onerror=alert(document.domain)>
4- Click Run and save then XSS will trigger.

Tested on Firefox and Chrome.

Impact:
The attacker can steal data from whoever checks the report.

Regards,
Richard

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/bagder/statuses/115587972672233599 on your instance and quote it. (Note that quoting is not supported in Mastodon.)