Today I sat down on my way to go grocery shopping and I saw those two beautiful pigeons.

Sadly, in Germany, you are not allowed to feed them. Just can’t feed pigeons, everything else is fine. That’s sad :c

Apparently, by default, the installer for Heroku CLI adds the path "%LOCALAPPDATA%/heroku" to the "Windows Defender exclusion".

So it might be that the path won't be scanned for threats and malware.

#redteam #penetrationtest #malware

I really can't believe it but I'm not surprised at all. This is also the reason why I wanna build my own stuff and self-host everything.

So I did: https://github.com/jackrendor/xsscane

It's not much, but I find it cool.

I just have to specify the usage.

If the payload above succeeds, you get Cookies, DOM, URL of the website that the victim is on.