Can you get XSS here Still ?? Please

Don't tell me about Open redirect & CSPT

both are possible!!
#js #html

This "boring" playlist turns you into a JS hacking

pro—real exploits, no fluff: tinyurl.com/fxrv4r32

From DOM manipulation to XSS tricks:

Who's ready to level up? 🔥

#JavaScript #WebHacking

Drop your go-to JS hack below! 👇

The browser security model is a fortress....

I expose client-side hacking tricks that could wreck your

apps (ethically, of course). Think you're safe?

Watch me break it : youtu.be/N0d43HXIm_s

#BrowserSecurity #JavaScript #CyberSecurity

Two alerts JavaScript’s lexer ambiguity

by x.com/nowaskyjr/st...

(5/5) For Client-Side Race Conditions based on network requests, you can slow down time by holding up the Connection Pool. Then slowly release them one by one, performing any actions you need in between with 100% consistency.

Just dropped a DEEP DIVE into HTTP Request

Smuggling (CL.TE Vulnerability) on YouTube!

Watch now: youtu.be/4cRPrmUMJa4

#Cybersecurity #WebSecurity #HTTPrequestSmuggling

Extended the starter with shy writers! 😀 If you're not on the list but write about web security, then feel free to reply with the article you're most proud of, and I will add you to the pack!

Make sure to resubscribe to not not miss on the amazing 🌐research!

go.bsky.app/9JXnB17

Following other's lead, I put together an XSS challenge to solve a somewhat tricky injection I'd come across. In producing the challenge I came up with my solution (so in that way I guess it served it's purpose) but interested in how other's would approach it 🤔

blog.ajxchapman.com/xss/challeng...

Finding Xss using CodeQl:
@knownsecrets.bsky.social

medium.com/@knownsec404...

Found an XSS but got blocked by the CSP?

https://cspbypass.com has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

bsky.app/profile/tomn...

I often know that I know something. But when having to ask quickly, I stumble. I might have to start generating some "flash card" style questions for myself to try to ingrain some knowledge a bit deeper.

This is an example from earlier this week. It's not hard, but how quick and certain are you?

The slides and examples for my talk "Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Origin Checks" at NahamCon can be found here: 0-a.nl/nahamcon/

For those who missed it, check out my talk, “Widgets Gone Wild: Exploiting XSS through Flawed postMessage Origin Checks.”

📺 Watch here: www.youtube.com/watch?v=qgB0...
🖥️ Follow along with the slides: 0-a.nl/nahamcon/

Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission.

portswigger.net/web-security...

Nice addition! The only one missing is let, const, class ”hoising in the temporal dead zone” 😉

on a serious note I dont think its needed. But all these snippets reminded me of my final challenge in this post joaxcar.com/blog/2023/12...

also made me realize glitch.me is gone. Need to re-host

Made a new small challenge where you have to break out of a web worker to leak a token in the URL

Only works in Firefox and Safari

joaxcar.com/fun/worker/a...