PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dom-Explorer tool launched to reveal how browsers parse HTML and find mutated XSS vulnerabilities

yeswehack.com | research | #open-source | #xss | #tooling | #mutation-xss | #dom-explorer | #html-parsing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Launch of Dom-Explorer: BitK's open-source tool showing how browsers and popular sanitisers parse HTML, helping researchers uncover mutation XSS bugs and iterate on ideas faster.
Published
Collected

Related coverage

research · volexity.com
Go Get ‘Em: Updates to Volexity Golang Tooling
# Go Get ‘Em: Updates to Volexity Golang Tooling August 11, 2025 Ivan Mladenov _This blog post was the final deliverable for asummer internship project, which was completed under the direction of...
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
research · yeswehack.com
New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup
Roundup: Dom-Explorer for mutated XSS, a $20k Chromium sandbox escape, Cfreal's lightyear for PHP blind file reads, and live Bug Bounty results from Ekoparty.
research · portswigger.net
Evading defences using VueJS script gadgets
VueJS script gadgets for evading defences: expression-based vectors, event tricks and mutation XSS in the framework, useful for bypassing WAFs and CSP and for developers guarding Vue apps.
research · portswigger.net
Bypassing DOMPurify again with mutation XSS
A fresh mutation XSS bypass of DOMPurify's patch: crafted comments and encoded tags mutate sanitized markup into executable XSS in Chrome, plus a CDATA variant for Firefox; fixed in DOMPurify 2.1.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
Back