PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Redefining Impossible: XSS without arbitrary JavaScript

portswigger.net | research | #web-security | #xss | #side-channel | #exfiltration | #tagged-templates | #charset-restriction
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Solving an 'impossible' XSS lab: with the payload confined to a single-quoted string and a tiny charset, Luan Herrera exfiltrates the cookie via side-channel techniques, not arbitrary JavaScript.
Published
Collected

Related coverage

research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
research · portswigger.net
Stealing HttpOnly cookies with the cookie sandwich technique
The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
The seventh way to call a JavaScript function without parentheses
Gareth Heyes documents a seventh way to call JavaScript functions without parentheses, exploiting how tagged-template placeholders are passed as typed arguments — insight for sandbox and WAF evasion.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
Back