Reposted by Johan CarlssonGareth Heyes @garethheyes.co.uk · 28/08/2025Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission. portswigger.net/web-security... 2187
Johan Carlsson @joaxcar.bsky.social · 28/08/2025Nice addition! The only one missing is let, const, class ”hoising in the temporal dead zone” 😉 on a serious note I dont think its needed. But all these snippets reminded me of my final challenge in this post joaxcar.com/blog/2023/12... also made me realize glitch.me is gone. Need to re-hostjoaxcar.comHaving fun with JavaScript hoistingWriteup of three JavaScript challenges posted on Twitter during November/December of 2023 231
Johan Carlsson @joaxcar.bsky.social · 18/08/2025I dont think thats a security boundary that is considered. But I might be wrong 110
Johan Carlsson @joaxcar.bsky.social · 07/08/2025Made a new small challenge where you have to break out of a web worker to leak a token in the URL Only works in Firefox and Safari joaxcar.com/fun/worker/a...joaxcar.comWeb Worker Test 381
Johan Carlsson @joaxcar.bsky.social · 14/07/2025yep, innerText will return "what the user sees." and html entities will look like their real value to users. and thus also in the innerText React and other frameworks will auto-encode input when used in their templates, but two here will undo that 010
Johan Carlsson @joaxcar.bsky.social · 13/07/2025ChatGPT got it wrong, Gemini2.5 made a lucky guess that was not all wrong, but with the wrong explanation 010
Johan Carlsson @joaxcar.bsky.social · 13/07/2025I often know that I know something. But when having to ask quickly, I stumble. I might have to start generating some "flash card" style questions for myself to try to ingrain some knowledge a bit deeper. This is an example from earlier this week. It's not hard, but how quick and certain are you? 271
Reposted by Johan CarlssonJulien | MrTuxracer @mrtuxracer.bsky.social · 10/07/2025I am a huge fan of the #BuyFromEU movement! So far, I've ditched a lot of US stuff already, including Microsoft, Dropbox, 1Password, Notion, Grammarly, Amazon, Slack, and Google. This helped a lot: european-alternatives.eueuropean-alternatives.euHomepage | European AlternativesWe help you find European alternatives for digital service and products, like cloud services and SaaS products. 3105
Reposted by Johan CarlssonGeluchat @gelu.chat · 04/07/2025Today was my last day as a pentester at Bsecure. After a three-year journey of hunting on the side, I’m ready to go all-in as a full-time bug bounty hunter. You can read about my journey from pentester to full-time hunter here: gelu.chat/posts/from-p...gelu.chatFinding Freedom, One Bug at a Time: My Journey from Pentester to Full-Time HunterAfter seven years in pentesting, I transitioned full-time into bug bounty hunting, leveraging deep experience and continuous learning. This article shares key moments and insights from that journey. 3247
Johan Carlsson @joaxcar.bsky.social · 05/07/2025Nice post! My journey followed a similar trajectory, but so far without the 200k LHE part :) Inspiring. I will try to ramp up a bit after vacation and see if I can get to the next level as well. Even if I am quite happy where I am coasting right now 020
Johan Carlsson @joaxcar.bsky.social · 02/07/2025At the same time I often think after a finding something strange and niche: ”wow nice the codebase must be full of similar issues, lets cash in!” only to find that the one issue I found is the only one that exists. 110
Johan Carlsson @joaxcar.bsky.social · 18/06/2025where are you? I have been enjoying south of France for two weeks now. A lot of great views, sunsets and the warm weather :) 110
Johan Carlsson @joaxcar.bsky.social · 17/06/2025This is great! have not had time to play with it yet but its definitely something I did not know I needed really badly 😄 120
Reposted by Johan CarlssonJorian @jorianwoltjer.com · 25/05/2025Double-Clickjacking, or "press buttons on other sites without preconditions". After seeing and experimenting with this technique for a while, I cooked up a variation that combines many small tricks and ends up being quite convincing. Here's a flexible PoC: jorianwoltjer.com/blog/p/hacki...jorianwoltjer.comThe Ultimate Double-Clickjacking PoC | Jorian WoltjerCombing a lot of browser tricks to create a realistic Proof of Concept for the Double-Clickjacking attack. Moving a real popunder with your mouse cursor and triggering it right as you're trying to bea... 262
Johan Carlsson @joaxcar.bsky.social · 25/05/2025Cool! This is the built out POC that I only hinted at in my report :) my version was way less stable. But I did have the “and now a super high pipe” trick in my flappy game. Inspiring work Jorian 010
Johan Carlsson @joaxcar.bsky.social · 22/05/2025A good suggestion, I think someone did try to use CSS in the challenge but failed. Never thought about it as a DOS vector 000
Johan Carlsson @joaxcar.bsky.social · 22/05/2025@garethheyes.co.uk feel free to ignore the challenge part here, but would be awesome with your thoughts on shared processes and stalling the cpu. Especially as I have seen hints that cross-origin could potentially share process, even as it sounds strange 100
Johan Carlsson @joaxcar.bsky.social · 20/05/2025Here is the official writeup of my XSS challenge on Intigriti. I think it contains some fun browser trivia even for those who did not look at the chall joaxcar.com/blog/2025/05...joaxcar.comConfetti: Solution to my Intigriti May 2025 XSS Challenge - Johan Carlsson 1186
Johan Carlsson @joaxcar.bsky.social · 19/05/2025links to blogs in discord is my new newsfeed. I recently found “the spanner” :) my issue is that I am to much of a perfectionist to blog. write too much and too long. Need to learn to just post 140
Johan Carlsson @joaxcar.bsky.social · 19/05/2025Yep too bad. For me it sort of just went into not using these platforms at all. Doing more Discord. But there is something to “tweets” that I like. My X feed is way better though (if you filter p0rn and crypto bots. and the gore). Will try reviving bluesky again to see if it can be done 030
Johan Carlsson @joaxcar.bsky.social · 19/05/2025This might be it. I kind of quit mastodon but it did have its own edge, while this place felt more like a watered out X. Might give it another go 100
Johan Carlsson @joaxcar.bsky.social · 18/05/2025I must have screwed up when setting up bluesky. Added to many “starterpacks”. My feed has been underwhelming. Any one have any idea if there is an active bug bounty community here and how to tap into it? 290
Johan Carlsson @joaxcar.bsky.social · 18/05/2025Oh now I remember how it all came together. I actually read about the inconsistency in “The tangled web”. Which made me look up the spec and found the table with invalid but parsable urls 010
Johan Carlsson @joaxcar.bsky.social · 17/05/2025Really great writeup @jorianwoltjer.com! The fuzzing part was inspiring. I originally found it myself by reading and playing with the docs. But I need to become more custom to just throw up small fuzzers myself 120
Reposted by Johan CarlssonJorian @jorianwoltjer.com · 17/05/2025The legendary @joaxcar.bsky.social made a really interesting XSS challenge this month for Intigriti. My solution involved winning a race condition with 100 <iframe>s to utilize a DOM Clobbering gadget after bypassing a RegEx. Check out the writeup below: jorianwoltjer.com/blog/p/hacki...jorianwoltjer.comIntigriti May XSS Challenge (0525) | Jorian WoltjerA challenge by @joaxcar with a small but complex XSS chain, hitting DOM Clobbering with a race condition and abusing a cool URL parsing quirk in JavaScript. 2127
Johan Carlsson @joaxcar.bsky.social · 09/05/2025I made a small Cross Site Scripting challenge for Intigriti that is live now. Feel free to practice your web hacking skills on it. “Based on a true story” as they say challenge-0525.intigriti.iochallenge-0525.intigriti.ioMay Challenge - IntigritiFind the XSS and WIN Intigriti swag. 190
Reposted by Johan CarlssonNicolas Grégoire @agarri.fr · 02/04/2025Getting feedback like this is what motivates me to work, again and again, on my Burp Suite training course. Thanks @joaxcar.bsky.social ☺️ 0204
Reposted by Johan CarlssonAlex Chapman @ajxchapman.bsky.social · 10/03/2025Following other's lead, I put together an XSS challenge to solve a somewhat tricky injection I'd come across. In producing the challenge I came up with my solution (so in that way I guess it served it's purpose) but interested in how other's would approach it 🤔 blog.ajxchapman.com/xss/challeng... 1135
Johan Carlsson @joaxcar.bsky.social · 03/02/2025yep, I have the same feeling. But I feel more and more uneasy about it. might need to lead by example and post more here 040
Johan Carlsson @joaxcar.bsky.social · 03/02/2025Finally taking the last steps to "remove" my Twitter account. As I don't want to get impersonated, I will just empty it out and leave it to die slowly. Is there any other way? Must admit my timeline here is not as interesting, but I guess that's up to me to fix. 5201
Reposted by Johan CarlssonBug Bounty Reports Explained @gregxsunday.bsky.social · 23/01/2025Little known trick to bypass CSP feat. @joaxcar.bsky.social #bugbounty #bugbountytips #bugbountyhunter 081
Reposted by Johan CarlssonBug Bounty Reports Explained @gregxsunday.bsky.social · 21/01/2025Three years ago, @joaxcar.bsky.social was just starting out with bug bounty. Today, he’s GitLab’s TOP1, has bugs on Google and Apple programs, and a reputation as one of the best client-side hackers. Check out our interview🔥 youtu.beEnjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube. 0143
Johan Carlsson @joaxcar.bsky.social · 15/01/2025I will bring that point up on the next scrum meeting. Might be able to create the Jira during next sprint 200
Johan Carlsson @joaxcar.bsky.social · 25/12/2024Another banger pod from BBRE! Really needed this inspiration going into the new year. Never thought about logger++ and elastic, need to test that out 081
Johan Carlsson @joaxcar.bsky.social · 20/12/2024Here is (finally) the writeup and conclusion of the challenge: joaxcar.com/blog/2024/12... Maybe not the best write-up, but I have to allow myself to actually post, rather than refactor, posts. I hope someone finds it useful. And thanks everyone that participated. Special shoutout to @terjanq.mejoaxcar.comSideloading external scripts: a code golf challenge - Johan Carlsson 0114
Johan Carlsson @joaxcar.bsky.social · 18/12/2024@jorianwoltjer.com came in with three solutions (🔥), and I decided to harden the challenge a bit. Sorry about that if anyone had something brewing. Still, at least three ways to break it 010
Johan Carlsson @joaxcar.bsky.social · 18/12/2024There are two unintended solves so far. Its hard to throw together a quick challenge and also keep it safe 😀 So far the solves are probably better than the intended solution anyways 020
Johan Carlsson @joaxcar.bsky.social · 18/12/2024⚠️Challenge time again⚠️ It is based on a real-world situation. Use the HTML injection to leak the flag to an external domain ☃️ This time, send solutions in DM; we don't want to spoil the fun. I also might want to patch any obvious blunder I made creating it joaxcar.com/xss/outer.ht... 2185
Johan Carlsson @joaxcar.bsky.social · 17/12/2024Nice feature! looks like fun little problems to solve 100
Johan Carlsson @joaxcar.bsky.social · 16/12/2024Was a blast hanging out with @gregxsunday.bsky.social a few hours in gray and cold Gothenburg! Glad that we finally got to meet in real life 060
Johan Carlsson @joaxcar.bsky.social · 12/12/2024Nice! Well the original research goal was to find the shortest pure js way of executing external content, given the CSP. But all answers are valid as they teach us something 020
