I'm sure I've gone over various forms of Cross Site Scripting (XSS) in previous posts but sometimes I gloss over XSS because it's a vulnerability I discover along the way to a root.  But make no mistake, while XSS could seem benign, it is not.  The Browser Exploitation Framework (BeEF), while partially functional at this point, is still plenty dangerous and proof of that.  For this post though, I won't use BeEF because I've already done so in another post around here somewhere.  Today I will take a more manual approach -- exploiting an XSS vulnerability in LayerBB version 1.1.2

With a regular user account, we login to the forum:

I can't remember when I first heard about this new Sandbox feature but when I did, I got excited.  There are a number of times when we all get a suspicious attachment and we're not quite sure if we want to open it or delete it.  If we all had a safe place to take a look, we would.  On the surface, the Sandbox feature sounded like that's what we would be getting with the 1903 update. 

I'll be honest, after seeing it, it should be called the "litter box" feature and you can use your imagination for my reasoning.  

1903 was released and I wasn't really paying attention because my computer updates frequently, reboots frequently, and I just assumed it was already present.  It wasn't but if you need to download it manually, here's the link:

I'm visiting a Linux users group tomorrow and part of their focus is the Raspberry Pi.  I've been working on my Pi recon device which I've called:  "consPire" but it's only half ready because I keep coming up with more ideas for what I want it to do.  Rather than bring a half baked project, I thought about other uses for the Pi.  One thing that came to mind, that's fairly simple to build, is a proxy server.  There are a number of uses for a proxy but at the very least, it's another layer between your browser and the Internet... so why not??

Scrounging around my desk, I found an extra MicroSD card and with balenaEtcher, I burned a Raspbian image to the card.  I used the lite version of Raspbian which lacks the GUI but it's a Pi and the GUI is S L O W.  Once the OS was installed and running, using raspi-config, I added SSH.  With SSH installed, I logged into the Pi and  I did everything else remotely.