Skip to content
JavaScript without parentheses using DOMMatrix
portswigger.net | research | #xss | #portswigger | #javascript | #waf-bypass | #payload | #dommatrix | #limited-charset
Summary
Gareth Heyes shows how to execute JavaScript without parentheses by abusing the DOMMatrix constructor to generate otherwise-forbidden characters, solving a limited-charset XSS challenge.
- Published
- Collected