PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

JavaScript without parentheses using DOMMatrix

portswigger.net | research | #xss | #portswigger | #javascript | #waf-bypass | #payload | #dommatrix | #limited-charset
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes shows how to execute JavaScript without parentheses by abusing the DOMMatrix constructor to generate otherwise-forbidden characters, solving a limited-charset XSS challenge.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
XSS without parentheses and semi-colons
Gareth Heyes adapts his classic onerror/throw trick to call functions without parentheses, semicolons or newlines, enabling XSS in heavily filtered contexts.
research · portswigger.net
When security features collide
James Kettle argues stacked security features can make systems easier to exploit, demonstrating a Cloudflare email obfuscation quirk that bypasses its WAF and all browser XSS filters.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Gareth Heyes uses visual fuzzing with headless Chrome and puppeteer to hunt Unicode combining characters that form render-defect Zalgo JavaScript, valid on Edge.
research · portswigger.net
One XSS cheatsheet to rule them all
Gareth Heyes launches PortSwigger's XSS cheatsheet, packed with novel filter-bypass vectors such as :target CSS transitions and hash-triggered focus events, each with a hosted PoC.
Back