PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Executing non-alphanumeric JavaScript without parenthesis

portswigger.net | research | #xss | #obfuscation | #javascript | #filter-bypass | #template-literals
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes executes non-alphanumeric JavaScript without parentheses by abusing template literals and Array.prototype.find, building filter-evading XSS payloads that previously helped hack Uber.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Bypassing character blocklists with unicode overflows
Unicode codepoint truncation turns overflow values into blocked ASCII characters — 0x4e41 % 256 yields 'A' — bypassing character blocklists; the trick now ships in ActiveScan++ and Hackvertor.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Gareth Heyes uses visual fuzzing with headless Chrome and puppeteer to hunt Unicode combining characters that form render-defect Zalgo JavaScript, valid on Edge.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
research · portswigger.net
Noscript XSS filter bypass
Gareth Heyes finds a NoScript XSS filter bypass using __defineSetter__ to trigger arbitrary function calls in script context, with window.name delivery across domains. Since patched.
Back