PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing JavaScript frameworks to bypass XSS mitigations

portswigger.net | research | #xss | #portswigger | #bypass | #noscript | #dom-based | #mavo | #javascript-framework
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes abuses the Mavo JavaScript framework's $url object to build DOM-based XSS that bypasses NoScript's XSS filter, and shows risks from attacker-controlled data sources.
Published
Collected

Related coverage

research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · portswigger.net
Noscript XSS filter bypass
Gareth Heyes finds a NoScript XSS filter bypass using __defineSetter__ to trigger arbitrary function calls in script context, with window.name delivery across domains. Since patched.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
Cracking the lens: targeting HTTP's hidden attack-surface
James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
Back