# cross-site scripting (blogs) — RSS Amplifier Recent posts from the 6 feeds in the RSS Amplifier directory that cover cross-site scripting. Page: Feed: --- ## [Backlog: A Local-First Task and Context Manager for Humans and AI](https://mazinahmed.net/blog/backlog-project/) _2026-07-07 · Mazin Ahmed_ I’ve been working with agentic AI for the past two years, and I kept hitting the same wall: managing the tasks and to-dos it generates. Moving what it learns between sessions. Improving a product without keeping one session open for days. Keeping a session open for days builds up context, and I get billed for all of it on every request to Claude. Caching helps, but it’s still… ## [The GitHub Breach Through VS Code Is the One I Warned About](https://mazinahmed.net/blog/github-vscode-breach/) _2026-05-22 · Mazin Ahmed_ If you haven’t heard the news, GitHub confirmed unauthorized access to internal repositories through a malicious VS Code extension. I’ve been warning about this. I predicted it would happen in my talk Compromising Developers with Malicious Extensions last December at Black Hat MEA, where I presented several flaws in VS Code and the marketplace and how people can use them to run supply… ## [How to Bypass CloudFront/AWS WAF and Pop Blind XSS](https://coopergyoung.com/how-to-bypass-cloudfront-aws-waf-and-pop-blind-xss/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-bypass-cloudfront-aws-waf-and-pop-blind-xss) _2026-01-28 · Cooper Young · Cooper Young_ I want to share some tips on one of my favorite vulnerability classes: blind cross-site scripting. One of the reasons I love blind XSS is that when a payload pops, it s almost always a critical vulnerability. When I first learned about XSS Hunter (an easy-to-use online tool that facilitates the blind XSS setup), I could... The post How to Bypass CloudFront/AWS WAF and Pop Blind XSS appeared first… ## [Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming](https://mazinahmed.net/blog/publishing-malicious-vscode-extensions/) _2025-12-06 · Mazin Ahmed_ Introduction # VS Code and AI-powered IDEs could lead to the largest security breaches in the industry in the near future. They’re installed on almost all developer machines globally. Developers have access to sensitive data and credentials to push code that ends up in production. A supply chain attack could lead to gaining access to developers’ machines, which in turn could provide entry to… ## [Introduction to Hacking LLMs: Jailbreaks & System Prompt Extraction](https://coopergyoung.com/introduction-to-hacking-llms-jailbreaks-system-prompt-extraction/?utm_source=rss&utm_medium=rss&utm_campaign=introduction-to-hacking-llms-jailbreaks-system-prompt-extraction) _2025-11-28 · Cooper Young · Cooper Young_ A recent branch of penetration testing has emerged around attacking Large Language Models (LLMs). The field is still young, which invites two notable consequences. To know how to hack LLMs, it s important to understand what they are. At their over-simplified core, Large Language Models are next-word predictors (more accurately, next-token predictors) that output a best ... The post Introduction to… ## [Chinese UNC6384 Malware Campaign Exploits Cambodia Thailand Crisis](https://martinkubecka.sk/posts/2025-10-29-chinese_unc6384_malware_campaign_exploits_cambodia_thailand_crisis/) _2025-10-29 · Martin Kubečka_ Diplomatic entities targeted in spearphishing campaign by UNC6384 cyber espionage. ## [Unsophisticated Phishing Delivering Sophisticated Malware](https://martinkubecka.sk/posts/2025-10-06-unsophisticated-phishing-delivering-sophisticated-malware/) _2025-10-06 · Martin Kubečka_ Deep dive analysis of an opportunistic phishing campaign delivering Katz Stealer and Remcos RAT. ## [CVE-2025-56683: DOM-based Cross-Site Scripting Leading to Remote Code Execution in Logseq Application](https://martinkubecka.sk/security-advisories/cve-2025-56683/) _2025-07-01 · Martin Kubečka_ A DOM-based XSS vulnerability in Logseq version 0.10.9 allows Remote Code Execution by injecting malicious JavaScript through unsanitized plugin README content combined with insufficient protocol validation. ## [How Machines Actually Work: 10 Takeaways from Hardwear.io 2025](https://coopergyoung.com/hardwear-io-2025-thought-dump-10-takeaways/?utm_source=rss&utm_medium=rss&utm_campaign=hardwear-io-2025-thought-dump-10-takeaways) _2025-06-24 · Cooper Young · Cooper Young_ A few weeks ago, I had the pleasure of attending Hardwear.io (yes, it s really spelled like that), a conference all about hardware security. I came in with very little hardware experience, which put me in a great position to learn from the ground up. Below are 10 takeaways to organize my thoughts and provide the... The post How Machines Actually Work: 10 Takeaways from Hardwear.io 2025 appeared… [Listen](https://coopergyoung.com/wp-content/uploads/2025/06/post-quantum-breaker.mp4) ## [Preventing Prompt Injection Attacks at Scale](https://mazinahmed.net/blog/preventing-prompt-injection-attacks-at-scale/) _2025-06-09 · Mazin Ahmed_ Prompt injection attacks are one of the most common LLM security threats we have all seen while reviewing LLM implementations, integrations, and AI-powered systems. I have identified Prompt Injection attacks in numerous implementations and applications, and I’ve decided to write a blog post to recommend different methodologies I experimented with that can prevent prompt injection at scale. I will… ## [Make any domain metal (Sponsored)](https://crawlproof.com/a/Exsx17P0vIYn) _2025-06-08 · **Sponsored**_ Turn any domain into a blacked-out metal landing page with an email waitlist ## [Exacerbating Cross-Site Scripting: The Iframe Sandwich](https://coopergyoung.com/exacerbating-cross-site-scripting-the-iframe-sandwich/?utm_source=rss&utm_medium=rss&utm_campaign=exacerbating-cross-site-scripting-the-iframe-sandwich) _2025-04-13 · Cooper Young · Cooper Young_ I m starting this post with adoration for the Critical Thinking Podcast. The podcast launched around the time I began hacking full-time, and I consider it my companion. It is required listening for bug bounty hunters, but I recommend it to anyone involved in cyber security—especially if you care about the offensive perspective (and you should).... The post Exacerbating Cross-Site Scripting: The… [Listen](https://coopergyoung.com/wp-content/uploads/2025/04/my-poc.mp4) ## [Hacking the Healthcare Industry: My First Critical Vulnerability](https://coopergyoung.com/hacking-the-healthcare-industry-my-first-critical-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=hacking-the-healthcare-industry-my-first-critical-vulnerability) _2025-03-24 · Cooper Young · Cooper Young_ The story begins with HackerOne, one of the leading bug bounty platforms. For those that don t know, many companies accept vulnerabilities as part of public vulnerability disclosure programs, or they invite established hackers to private programs. The good ones even offer rewards. This is a big change from hacking twenty years ago, when a company... The post Hacking the Healthcare Industry: My… ## [Hello, World! Welcome To My Hacking Blog](https://coopergyoung.com/hello-world-welcome-to-my-hacking-blog/?utm_source=rss&utm_medium=rss&utm_campaign=hello-world-welcome-to-my-hacking-blog) _2025-03-24 · Cooper Young · Cooper Young_ Introduction At the time of this writing, I’ve worked in cybersecurity for two+ years as a penetration testing consultant (aka an ethical hacker). Each week, I target a new company’s systems, identifying and reporting vulnerabilities that I find. The fast-paced and varied nature of this work has provided me experience with a wide range of... The post Hello, World! Welcome To My Hacking Blog… ## [Introducing LLMQuery Framework: Scaling GenAI Automation with Prompt Templates](https://mazinahmed.net/blog/llmquery-project/) _2025-01-13 · Mazin Ahmed_ Large Language Models have completely changed how we automate, create, and solve problems. Integrating and experimenting with these models across different providers, along with optimizing LLM prompts and benchmarking them, can feel overwhelming. That’s why I built llmquery this year, to make interacting with Large Language Models and prototyping new GenAI-powered applications simpler and faster.…