iiinova — where your digital self keeps evolving

Reposted by 0x999

Kévin Gervot (Mizu) @mizu.re · 24/07/2025

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

12313

0x999 @0x999.net · 16/07/2025

New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking...

0x999.net

Leaking IPs in Brave Tor Window & Chrome VPNs + Popunders + CSP Bypass

This writeup details multiple IP leak vulnerabilities I discovered affecting Brave's Tor window and Chrome VPN extensions that allowed a malicious actor to leak the real IP address of any visitor to a...

055

Reposted by 0x999

Gareth Heyes @garethheyes.co.uk · 04/06/2025

Abuse EvalError, onpageswap, and setTimeout to get JS execution without parens. @0x999.net redirects the page to trigger onpageswap, hijacks the thrown error, and turns it into code. Inspired by @terjanq.me. Now available on the XSS cheat sheet. Link to vector👇 portswigger.net/web-security...

$<script> onpageswap=setTimeout; location='x'; Event.prototype.toString=EvalError.prototype.toString; Event.prototype.name='alert\x281\x29' </script>$

0134

Reposted by 0x999

Gareth Heyes @garethheyes.co.uk · 03/06/2025

This vector adds an onerror handler with eval, rewrites all ReferenceError names, then triggers an error to execute the payload. Just added it to the XSS cheat sheet. Credit to @0x999.net , inspired by @terjanq.me portswigger.net/web-security...

$<img/src/onerror=window.onerror=eval;ReferenceError.prototype.name=';alert\x281\x29;var\x20Uncaught//';z>$

053

Reposted by 0x999

Gareth Heyes @garethheyes.co.uk · 29/05/2025

Crafty JavaScript-context XSS vector using ondevicemotion, setTimeout, and URIError spoofing to trigger alert(1) now added to the XSS cheat sheet. By @0x999.net inspired by @terjanq.me Link to vector👇 portswigger.net/web-security...

$ondevicemotion=setTimeout; Event.prototype.toString=URIError.prototype.toString; Event.prototype.message='alert\x281\x29'$

0112

Reposted by 0x999

Jorian @jorianwoltjer.com · 02/04/2025

This month, @0x999.net made an awesome and difficult Intigriti XSS challenge. I really enjoyed the openness of this challenge resulting in an unintended solution and the first solve 🩸! Check out how I got there in my writeup below: jorianwoltjer.com/blog/p/hacki...

jorianwoltjer.com

Intigriti March XSS Challenge (0325) | Jorian Woltjer

A hard Cross-Site Scripting challenge chaining small bugs with one very hard step to leak a fragment directive using Self XSS

042

0x999 @0x999.net · 24/03/2025

I made a little challenge for @intigriti.com Goal: Steal the Bot's flag!⛳️ Try it out 👇

110

Reposted by 0x999

Gareth Heyes @garethheyes.co.uk · 23/03/2025

The Spanner is back! 🎉 I finally ditched WordPress for a custom blogging system. If you miss the golden era of web hacking, you’ll love revisiting classics like mXSS, DOM Clobbering, and RPO. Plus, plenty of quirky, vintage research gems. thespanner.co.uk

Reposted by 0x999

Kévin Gervot (Mizu) @mizu.re · 10/02/2025

I'm very happy to finally share the second part of my DOMPurify security research 🔥 This article mostly focuses on DOMPurify misconfigurations, especially hooks, that downgrade the sanitizer's protection (even in the latest version)! Link 👇 mizu.re/post/explori... 1/2

22711

Reposted by 0x999

Gareth Heyes @garethheyes.co.uk · 28/01/2025

Discover blocklist bypasses via unicode overflows using the latest updates to ActiveScan++, Hackvertor & Shazzer! Thanks to Ryan Barnett and Neh Patel for sharing this technique. portswigger.net/research/byp...

GET /%0D%0ASet-Cookie: foo=bar
403 Forbidden

GET /%E4%BC%8D%E4%BC%8ASet-Cookie: foo=bar
200 OK
Set-Cookie: foo=bar

03822

0x999 @0x999.net · 15/01/2025

My blog post, "Exploring Javascript Events & Bypassing WAFs via Character Normalization" has been nominated for the Top 10 Web Hacking Techniques of 2024!☺️ If you found it useful, I’d greatly appreciate your vote at the link below 👇 portswigger.net/polls/top-10...

060

Reposted by 0x999

terjanq @terjanq.me · 14/12/2024

Got sniped into the challenge and ended up doing some cool XSS research :D 11 char XSS with mind-boggling race-conditions. TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char) It's shorter than location=name !! terjanq.me/solutions/jo...

terjanq.me

11 char XSS (slow race-condition)

13011

0x999 @0x999.net · 02/12/2024

Very cool technique by @nastystereo.com for POST based CSRF without a content-type header using a Blob object, Interestingly it also seems to work using a Uint8Array

fetch('https://example.com/endpoint', {
method: 'POST',
mode: 'no-cors',
credentials: 'include',
body: new TextEncoder().encode(JSON.stringify({x:"x"}))
})

061

Reposted by 0x999

Jorian @jorianwoltjer.com · 27/11/2024

To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all. If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this! jorianwoltjer.com/blog/p/hacki...

jorianwoltjer.com

Post: Mutation XSS: Explained, CVE and Challenge | Jorian Woltjer

Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online

0239

Reposted by 0x999

Johan Carlsson @joaxcar.bsky.social · 19/11/2024

Here is the "writeup". Hope its clear enough, otherwise ask in comments. Note that there are two paths that will result in XSS. And that the "error path" can be reached in numerous different ways, like alternative 1 and 4. Alternative 5 hits the "successful path" and can also be used in many ways

3163

0x999 @0x999.net · 18/11/2024

Just published a new blog post "Exploring Javascript events & Bypassing WAFs via character normalization", check it out: 0x999.net/blog/explori...

0x999.net

0x999's Blog - Exploring Javascript events & Bypassing WAFs via character normalization

031

Reposted by 0x999

James Kettle @jameskettle.com · 17/11/2024

We’re finally live! You can now watch “Listen to the whispers: web timing attacks that actually work” on YouTube: youtube.com/watch?v=zOPj...

youtube.com

YouTube

Share your videos with friends, family, and the world

0359

Reposted by 0x999

renniepak @renniepak.nl · 17/11/2024

Some cool new additions at CSPBypass.com by omidxrz For example: cspbypass.com#onetrust <3

cspbypass.com

CSP Bypass Search

094

0x999 @0x999.net · 15/11/2024

I made a little xss challenge based on an upcoming blogpost, if anyone wants to check it out: xss.0x999.net Goal: 1. Alert the flag 2. Execute arbitrary javascript

xss.0x999.net

XSS Challenge

010