{"action":"created","issue":{"url":"https://api.github.com/repos/bkimminich/juice-shop/issues/365","repository_url":"https://api.github.com/repos/bkimminich/juice-shop","labels_url":"https://api.github.com/repos/bkimminich/juice-shop/issues/365/labels{/name}","comments_url":"https://api.github.com/repos/bkimminich/juice-shop/issues/365/comments","events_url":"https://api.github.com/repos/bkimminich/juice-shop/issues/365/events","html_url":"https://github.com/bkimminich/juice-shop/issues/365","id":243258266,"number":365,"title":"JSONP challenge","user":{"login":"tghosth","id":13623828,"avatar_url":"https://avatars1.githubusercontent.com/u/13623828?v=4","gravatar_id":"","url":"https://api.github.com/users/tghosth","html_url":"https://github.com/tghosth","followers_url":"https://api.github.com/users/tghosth/followers","following_url":"https://api.github.com/users/tghosth/following{/other_user}","gists_url":"https://api.github.com/users/tghosth/gists{/gist_id}","starred_url":"https://api.github.com/users/tghosth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tghosth/subscriptions","organizations_url":"https://api.github.com/users/tghosth/orgs","repos_url":"https://api.github.com/users/tghosth/repos","events_url":"https://api.github.com/users/tghosth/events{/privacy}","received_events_url":"https://api.github.com/users/tghosth/received_events","type":"User","site_admin":false},"labels":[{"id":417174987,"url":"https://api.github.com/repos/bkimminich/juice-shop/labels/challenge","name":"challenge","color":"fbca04","default":false},{"id":130877352,"url":"https://api.github.com/repos/bkimminich/juice-shop/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-07-16T18:48:36Z","updated_at":"2017-07-19T19:16:33Z","closed_at":null,"body":"JSONP can allow a sort of reverse CSRF attack whereby you can make the victim access data and send it to you. For example:\r\nhttps://securitycafe.ro/2017/01/18/practical-jsonp-injection/\r\n\r\nDo you think this would make an interesting challenge?"},"comment":{"url":"https://api.github.com/repos/bkimminich/juice-shop/issues/comments/316488753","html_url":"https://github.com/bkimminich/juice-shop/issues/365#issuecomment-316488753","issue_url":"https://api.github.com/repos/bkimminich/juice-shop/issues/365","id":316488753,"user":{"login":"bkimminich","id":3531020,"avatar_url":"https://avatars2.githubusercontent.com/u/3531020?v=4","gravatar_id":"","url":"https://api.github.com/users/bkimminich","html_url":"https://github.com/bkimminich","followers_url":"https://api.github.com/users/bkimminich/followers","following_url":"https://api.github.com/users/bkimminich/following{/other_user}","gists_url":"https://api.github.com/users/bkimminich/gists{/gist_id}","starred_url":"https://api.github.com/users/bkimminich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkimminich/subscriptions","organizations_url":"https://api.github.com/users/bkimminich/orgs","repos_url":"https://api.github.com/users/bkimminich/repos","events_url":"https://api.github.com/users/bkimminich/events{/privacy}","received_events_url":"https://api.github.com/users/bkimminich/received_events","type":"User","site_admin":false},"created_at":"2017-07-19T19:16:33Z","updated_at":"2017-07-19T19:16:33Z","body":"True, I forgot that one. It's exactly to have a nice CSRF hole in the app."}}
{"actor":{"display_login":"bkimminich"}}