PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing CSP using polyglot JPEGs

portswigger.net | research | #burp-suite | #web-security | #xss | #javascript | #csp-bypass | #polyglot-jpeg
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
Published
Collected

Related coverage

research · portswigger.net
Burp Clickbandit: A JavaScript based clickjacking PoC generator
PortSwigger releases Burp Clickbandit, a pure-JavaScript point-and-click tool that generates clickjacking proof-of-concept attacks, including multi-click attacks, directly from within Burp.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
tool · github.com
Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript
Streamlines JavaScript reconnaissance during bug bounty hunting and web penetration testing by uncovering hidden attack surfaces and exposed secrets with minimal noise.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
Back