We just released the first episode of our new video series: Proof of Concept!
Where we explain the vulnerabilities we find at Aikido with visuals and an interview-style.
This episode is about the Gogs RCE vulnerability affecting default configuration:
youtu.be/QIgr61KhcDo
youtu.be
RCE from a nested repo trick in Gogs!
YouTube video by Aikido Security
![JS Crossword
a crossword where the clue = eval(answer)
Welcome to JS Crossword! Every clue is a JS eval of its answer - for example, 7 could be solved with 3+4 and [object Object] could be solved with []+{}. This crossword uses some lesser-known and cursed JS features, so I'd recommend it for people already somewhat familiar with JavaScript.
You're allowed to use the following characters: A-Za-z0-9!"()*+-./<=>[]`{}. This means that no spaces (empty squares), commas, or semicolons are allowed to be used. The crossword is case-sensitive. The final answer consists only of english words, so it must match A-Za-z.
Your answers will be evaluated within an eval() sandbox, you can try it out at the playground below. You're of course also allowed to use other resources, such as DevTools, MDN, searching etc. This crossword is human-made, so if you solve it with AI you're lame, learn to have fun.
You can change the writing direction by clicking a square or pressing ctrl. Your progress is saved](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:bzdtu4vjo2quk2ef3ykhqtv6/bafkreihahkjvdq7izw3ceu67l6ufox2k6rnskol2ixsefcexujclesljqq)
![<iframe id="iframe" src="https://target.tld/dangling-object"></iframe>
<script>
iframe.onload = () => {
const object = iframe.contentWindow[0];
object.location = "about:blank"; // Navigate to our same-origin
const interval = setInterval(() => {
object.origin; // When it becomes same-origin
clearInterval(interval);
alert(object.name); // Leak its name (kept after navigation)
})
}
</script>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:3ffrnqiish5sra3vcmrjox72/bafkreih6xpe7qtncthrcpirpiu3smiyhsixw56kh6vrjkf6p6jtewsjydm)
