PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Evading CSP with DOM-based dangling markup

portswigger.net | research | #browser-security | #xss | #portswigger | #csp-bypass | #dangling-markup | #window-name | #dom-based
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
Published
Collected

Related coverage

research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Bypassing CSP with dangling iframes
A CSP bypass found when Chrome 97 broke a dangling-markup lab: setting a cross-domain iframe to about:blank hands ownership to the attacker, exposing window.name and running script despite CSP.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
Abusing JavaScript frameworks to bypass XSS mitigations
Gareth Heyes abuses the Mavo JavaScript framework's $url object to build DOM-based XSS that bypasses NoScript's XSS filter, and shows risks from attacker-controlled data sources.
Back