Bridge probe

Security research — HackerOne report to Basecamp. Contact: yassine.hallouzi@outlook.com

JavaScript interfaces bound to this page

Context

Methods

Credential gate

One bridge message, two attachments. A becomes app.basecamp.com once -preview is deleted. CTL merely contains the literal string. Only A should receive the Authorization header.