Replying to
@buherator@infosec.place I‘m pretty sure, the answer is not 2.
Remote
Konstantin 
@kpwn@infosec.exchange
mastodon 4.8.0-alpha.3+glitchI'm a hacker and mainly post about web security.
By profession, I am a pentester and team leader @usdAG@infosec.exchange.
I like to explain and understand things and I am convinced that the two go hand in hand.
So my posts are mostly of an educational nature.
Lately, I spend most of my free time developing CVE Crowd.
⎯⎯⎯⎯⎯⎯
Recent topics:
#CveCrowd, #Phishing, #CVSS, #PromptInjection, #OTP, #JavaScript, #HSTS, #BSCP
1282 Followers
242 Following
15 Posts
Joined December 21, 2022
I've finally replaced the old-school CAPTCHA required to sign up on https://cvecrowd.com with an open-source, privacy preserving, accessible, and globally compliant alternative: ALTCHA
It relies on proof of work and I am super hyped to see whether it will prevent bots from signing up. I'll keep you updated :)
Replying to
@GossiTheDog What really hurts about this is that the AI-assisted group performs better than the control group.
This means its tempting to use AI to increase performance. Especially in a competitive setting (like everywhere in capitalism) you'll "win" with AI assistance.
And in the end, we are left with a group of winners who have less persistence and reduced independent performance. And there's no way out.
Apparently #Safari on #iOS applies img-src directives of the content security policy to *object tags* that load images like so: https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/551/708/143/302/638/original/8f107909c923fd55.png">
This was the reason, why https://cvecrowd.com did not display avatars on iOS devices: I was using object tags and the object-src directive.
Fixed it by adding an img-src directive as well.
Damn! Close enough.
I solved the daily #CluesBySam, May 31st 2026 (Hard), in less than 13 minutes
🟨🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
Finally a perfect solve again 
I solved the daily #CluesBySam, May 27th 2026 (Medium), in less than 9 minutes
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
Replying to
@me@infosec.exchange I‘d go with: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Score: 5.1/Medium
A requirement for the attack, is the knowledge of a registered email address. However, I find this not enough to justify AT:P.
Active User Interaction is definitely required because the victim has to click the link.
There are no subsequent systems, so we only have to care about the vulnerable system (the vulnerable web app).
Confidentiality is impacted because the confidential one-time reset token is leaked.
Integrity is impacted because the token can be used to change another user‘s password.
What do you think?
Anyone else having the issue that avatars on https://cvecrowd.com are not loading on a mobile device?
Perfect streak: 2 😊
I solved the daily #CluesBySam, Jun 2nd 2026 (Medium), in 04:42
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
One reason to look forward to mondays. Easy Clues by Sam puzzles.
I solved the daily #CluesBySam, Jun 1st 2026 (Easy), in 05:23
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
This one was cumbersome. Had an early error… This always tempts me to use hints because a perfect solve isn‘t possible anymore.
I solved the daily #CluesBySam, May 30th 2026 (Hard), in less than 14 minutes
🟩🟩🟩🟩
🟩🟨🟩🟩
🟠🟩🟩🟡
🟩🟨🟩🟩
🟩🟠🟩🟩
https://cluesbysam.com
Perfect streak gone. But I'm still happy with today’s result, given the advanced difficulty 😊
I solved the daily #CluesBySam, May 29th 2026 (Tricky), in less than 8 minutes
🟩🟩🟩🟨
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
Perfect solve streak: 2 🎉
I solved the daily #CluesBySam, May 28th 2026 (Tricky), in less than 13 minutes
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
🟩🟩🟩🟩
https://cluesbysam.com
Replying to
@me@infosec.exchange Who are "some people"? :)
Attack Complexity (AC) measures actions taken by the attacker to actively circumvent existing built-in security-enhancing conditions.
What kind of circumvention and evasion must be fulfilled? As far as I see there aren't any.
Attack Requirements (AT) emerge naturally as a consequence of the deployment, not explicitly as an attack mitigation.
According to your argument, it's always AT: Present because every attack requires the attacker to use and setup a computer.
For the scoring to work, you have to assume the most powerful attacker possible, who of course has already set up a rouge password reset URL.
As I said, the only real requirement is the knowledge of an existing email address. With billions of leaked email addresses on the Internet, I am not sure this is a hard requirement to overcome.