iiinova — where your digital self keeps evolving

Kévin Gervot (Mizu) @mizu.re · 07/09/2026

A logical bug that I've reported to MariaDB has just been disclosed! 🎉 It's a nice logic issue that allows any user (no matter their rights) to update the password of any other user, including root :D You can find more details 👇 hackerone.com/reports/3876...

195

Kévin Gervot (Mizu) @mizu.re · 17/08/2026

Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇 mizu.re/post/dompuri...

042

Kévin Gervot (Mizu) @mizu.re · 12/04/2026

The #FCSC2026 ended today, and my write-ups are now available here: mizu.re/post/fcsc-20... 🚩 I'm really happy with the challenges I managed to create this year! It would be too long to list everything, so here's a little teaser below 👇 1/2

110

Kévin Gervot (Mizu) @mizu.re · 08/04/2026

I'm happy to release the first version of my DOMLogger++ plugin for @caido.io! 🔎 It improves the browser extension in several ways: • Persistent, per-project storage • Temporary session recording • AI support • Stack trace reconstitution • ... 👉 github.com/kevin-mizu/d...

031

Kévin Gervot (Mizu) @mizu.re · 24/10/2025

A quick update has been made to DOMLogger++ to add / update a few things. It's not a big deal, but it should allow interesting stuff to be done :) It should be available on the stores in the coming hours.

000

Kévin Gervot (Mizu) @mizu.re · 08/09/2025

For the @ASIS_CTF, I created a challenge based on an interesting (novel?) DOM Clobbering technique! 🚩 In short, in non-strict mode, HTMLCollection items are not writable. This blocks property assignment, allowing unexpected values to be created 😄 👉 mizu.re/post/under-t...

040

Kévin Gervot (Mizu) @mizu.re · 03/09/2025

Small teaser for Caido users :) 2/2

020

Kévin Gervot (Mizu) @mizu.re · 03/09/2025

DOMLogger++ v1.0.9 is now out and available! 🎉 This update fixes a lot of issues, including the historical DevTools bug on Chromium 🔥 It also brings full Caido session handling, which is going to be useful in the near future! 👀 👉 github.com/kevin-mizu/d... 1/2

120

Kévin Gervot (Mizu) @mizu.re · 25/08/2025

For example, using this configuration, it is possible to retrieve the @masatokinugawa.bsky.social CVEs in TinyMCE. 👉 subdomain1.portswigger-labs.net/xss/xss.php?... 2/3

110

Kévin Gervot (Mizu) @mizu.re · 25/08/2025

I've released a DOMLogger++ config that helps detect any replacements occurring in a DOMPurify output by inserting and tracking a canary value at runtime. I think it highlights how useful DOMLogger++ can be for tracking JS execution :D 👉 github.com/kevin-mizu/d... 1/3

130

Kévin Gervot (Mizu) @mizu.re · 24/07/2025

Each library page includes: * Affected versions * A short description * Root cause of the gadget * Related links * Credit to the discoverer * And even a preview button to play with the gadget live! 3/4

100

Kévin Gervot (Mizu) @mizu.re · 24/07/2025

The wiki lets you filter gadgets by browser, tags, attributes, CSP, and timing, making it as easy as possible to find interesting vectors (at least I hope so!) 🔎 2/4

100

Kévin Gervot (Mizu) @mizu.re · 24/07/2025

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

12313

Kévin Gervot (Mizu) @mizu.re · 22/05/2025

I've released my CTF bot template! :D It's not a big deal, but it comes with a heavily hardened Docker setup. The bot also sends a lot of debugging information over the TCP socket (console logs, navigation), which makes remote debugging much easier! 🔎 👉 github.com/kevin-mizu/b...

052

Kévin Gervot (Mizu) @mizu.re · 28/04/2025

The #FCSC2025 ended yesterday, and my write-ups are now available here 👇 mizu.re/post/fcsc-2025… Btw, like every year, all the challenges have also been added to hackropole.fr! 🚩 1/2

262

Kévin Gervot (Mizu) @mizu.re · 18/04/2025

This year again, with @bi.tk, we've made the Web challenges 🚩 The CTF is solo and lasts 10 days, if you have some time, please give it a look 😁 Btw, even if you're not doing Web challenges, there are 100+ challenges in various categories, you should find something you like!

1144

Kévin Gervot (Mizu) @mizu.re · 02/03/2025

For this challenge, it was necessary to abuse a discrepancy between the DOM and the rendered page in Firefox's cache handling 💽 👉 bugzilla.mozilla.org/show_bug.cgi... This allows to shift iframe rendering from one to another leading to a sandbox bypass 🔥 👉 mizu.re/post/an-18-y...

091

Kévin Gervot (Mizu) @mizu.re · 28/02/2025

With @gelu.chat, we created a challenge for the @pwnmectf inspired by a bug he found in bug bounty a year ago! 🚀 If you have some time this weekend, give it a try! 👀 👉 pwnme.phreaks.fr

0144

Kévin Gervot (Mizu) @mizu.re · 27/02/2025

DOMLogger++ v1.0.8 is now out and available! 🎉 This update includes several UX improvements, such as syntax highlighting and new shortcuts. Major changes have been made to custom types and several annoying bugs have been fixed 🚀 👉 github.com/kevin-mizu/d...

081

Kévin Gervot (Mizu) @mizu.re · 10/02/2025

The solution to this challenge is available here: mizu.re/post/explori... :)

040

Kévin Gervot (Mizu) @mizu.re · 07/02/2025

Thanks to the recent @portswiggerres.bsky.social top 10, I finally found the motivation to finish writing the 2nd article about DOMPurify security! 😁 Before releasing it, I would like to share a small challenge 🚩 Challenge link 👇 challenges.mizu.re/xss_04.html 1/2

1176