t0xodile.com
Security researcher at PortSwigger. You can find all of my write-ups and research at https://thomas.stacey.se.
👤 Joined on 27 December 2023
Followers
Following
Total Posts
@t0xodile.bsky.social@t0xodile.bsky.social → @t0xodile.comBuilding on my research, my colleague Alex exfiltrated a 600-character hex token instantly using just background images and selectors. No recursive imports. portswigger.net/research/sma...
Show PostChrome's new <microphone> tag has something to say: Another XSS vector for our cheat sheet, found by omidxrz. portswigger.net/web-security...
Show PostChrome added a <camera> tag. omidxrz made it an XSS vector: Now in our XSS cheat sheet. portswigger.net/web-security...
Show PostAn unauth stored XSS I found was disclosed yesterday. TLDR: X-Forwarded-For header gets logged as your IP without ever being checked, then runs in the admin's browser when they open the error log 😈 cryptocat.me/blog/researc...
Show Post