How I hacked chess.com with a rookie exploit

1

Lichess

#Chess #Games #Online Games 893 social mentions

2

Chess.com

Clearly chess.com was using something like "starts with" to process the re-upload. Basically don't re-upload if it starts with https://chess.com, but filter out if it starts with https://chess.com/registration-invite Typically same origin policies are relaxed for things like images by default [0]. So they came up with a trampoline, they created a chess.com.theirDomain.tld to get past the re-upload filter, which in turn returned a redirect, which the browser followed. [0] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#cross-origin_network_access.

#Chess #Games #Online Games 11425 social mentions