Securitum Research
research.securitum.com · Company blog · on HN since 2019
Securitum's security research team publishes web vulnerability write-ups on XSS, DOMPurify bypasses, prototype pollution, and CSS data exfiltration.
What HN saysCommenters cite its write-ups as concrete examples of HTML sanitizer failures and CSS-based data theft, as well as the fail2ban remote code execution bug.
19HN people shared it
9linked it in comments
16stories submitted
481story points
1 year agolast shared
2019people per year2026
Most-shared posts
- 1Chrome canary and same origin bypass with 10k bounty research5 people · 9 points · first shared 2019 · discussion on HN
- 2DOMPurify bypass: XSS via HTML namespace confusion4 people · 161 points · first shared 2020 · 81 comments on HN
- 3Fail2ban – Remote Code Execution3 people · 169 points · first shared 2021 · 62 comments on HN
- 4The Curious Case of Copy and Paste2 people · 63 points · first shared 2020 · 31 comments on HN
- 5Exploiting prototype pollution2 people · 54 points · first shared 2019 · 13 comments on HN
- 6XSS in GMail’s AMP4Email via DOM Clobbering2 people · 2 points · first shared 2019 · discussion on HN
- 7CSS data exfiltration in Firefox via a single injection point1 people · 19 points · first shared 2020 · discussion on HN
- 8Write-up of DOMPurify 2.0.0 bypass using mutation XSS1 people · 2 points · first shared 2019 · discussion on HN
- 9Comparison Of Reverse Image Searching In Popular Search Engines1 people · 2 points · first shared 2021 · discussion on HN
- 10Stealing data in great style how to use css to attack web application1 people · first shared 2025
- 11Prototype pollution and bypassing client side html sanitizers1 people · first shared 2022
What HN people wrote when they linked it
bawolff · 2025-09-26
You can do more than individual characters, you can use ligatures to adjust combinations of characters
https://research.securitum.com/stealing-data-in-great-style-how-to-use…
nyanpasu64 · 2022-09-25
My favorite example of the technical failings of HTML: https://research.securitum.com/mutation-xss-via-mathml-mutation-dompur… is a HTML sanitizing vulnerability that came about because some HTML not only doesn't survive a parse-stringify cycle, but the generated DOM tree does not survive a stringify-parse cycle!
rdslw · 2020-10-08
Yes, because it is worth in pentesting services 180k USD, no more no less. I mean, you can pay around 360k in London or SV rates and 180k in European for _similar_ skills people.
Calc based on 3 months, 5 people, 600USD/md rate.
EDIT as I can't reply to tpaceck below: no, those 2000usd/day rates do not exists in projects in size of 300MD like here. In general they do not exist for big projects.
Yes, I agree, you have rates around 1200 in high cost countries, yet as I wrote earlier, you can have similar/the same skill level at 600 usd/md if you're willing to work with guys not from HCC.
As to the skills I'm talking this level: https://research.securitum.com/mutation-xss-via-mathml-mutation-dompur…
cookiengineer · 2022-11-27
Remember when fail2ban had an RCE to execute things on a server via root user and it was as simple as parsing an email string because it was executing the mail binary on the other end? [1]
That's pretty much the reason why I started to write my own guard tools.
I don't need people from China or Russia logging in to my server. I don't understand why tools like this are never built in an ASN aware manner, blocking mechanisms would be so much easier.
[1] https://research.securitum.com/fail2ban-remote-code-execution/
lol768 · 2022-04-06
<portal> is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged.
It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a work in progress!" (three years ago).
Refs:
- https://research.securitum.com/security-analysis-of-portal-element/
- https://github.com/mozilla/standards-positions/issues/157
ridiculous_fish · 2022-03-19
I had to look up what prototype pollution is. This post has a good explanation [1].
The attacker construct an object on your server which contains an own-property '__proto__'. This is straightforward to do if you decode user-supplied JSON (e.g. a REST API) but this alone is not a vulnerability.
The vulnerability occurs when you iterate over this object's own-properties and use the resulting keys on another object. If the attacker can arrange for `obj2[key].value =...`, where 'key' is taken from the first object, then they have modified Object.prototype, which affects all other objects.
1: https://research.securitum.com/prototype-pollution-and-bypassing-clien…
maple3142 · 2021-10-20
Because DOMPurify is not perfect. Due to some problem of HTML parsing, there were some ways to bypass it: https://research.securitum.com/mutation-xss-via-mathml-mutation-dompur…
Having a builtin XSS sanatizer means it could always use a single parser to prevent such bypass.
loeg · 2021-09-25
You know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-execution/ . It’s adding extra attack surface for a cosmetic benefit.
furstenheim · 2021-04-21
This article is not very good in convincing that prototype pollution is a problem.
There was a write up about the kibana rce that really shows it's a problem:
https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019…