Automating DOM XSS Discovery
· ☕ 9 min read
How to automate DOM XSS discovery using semgrep and a single Python script.
Posts
Mitigation schmitigation: Control HttpOnly cookies through XSS
· ☕ 4 min read
How HttpOnly can be beaten with XSS
Fuzz the Unfuzzable
· ☕ 7 min read
4 useful ways to fuzz stuff that many people would consider 'unfuzzable'.
Cheatsheet: XSS that works in 2021
· ☕ 5 min read
XSS Cheatsheet for 2021 and onwards.
Escape Static Website Dependency Hell with Hugo
· ☕ 8 min read
Static website dependency hell and how Hugo can help you escape from it.
Breaking Python 3 eval protections
· ☕ 7 min read
How Python 3's eval works and how to abuse it from an attacker perspective to evade its protections.
100% evasion - Write a crypter in any language to bypass AV
· ☕ 13 min read
Design & Implementation of a crypter in any language, using Xencrypt (Powershell) as an underlying example.
Actual XSS in 2020
· ☕ 6 min read
XSS Cheatsheet for 2020.
Tradecraft - This is why your tools and exploits get detected by EDR
· ☕ 5 min read
Common reasons why payloads get picked up by EDRs.
Minitip - Stored XSS through SVG
· ☕ 1 min read
How to find persistent XSS through SVG files.