Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇 mizu.re/post/dompuri...

Show Post

We've all been there: found an XSS, blocked by CSP. There's a bunch of CSP bypasses that you can try by @renniepak.nl: https://cspbypass.com It has a compilation of bypasses, based on the exact CSP you're up against.  Here’s a quick tutorial on how to use it 👇

Show Post

Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...

Show Post

I don my hat to this headline.

Show Post

If you haven't tried Shazzer yet you should give it a go. You can easily find browser behaviour and get it tested by other users or your team. It supports private vectors too and you can assign them to your team. You can even have your own private fuzzing network. 🔥🔥🔥

Show Post