Skip to content
Executing non-alphanumeric JavaScript without parenthesis
portswigger.net | research | #xss | #obfuscation | #javascript | #filter-bypass | #template-literals
Summary
Gareth Heyes executes non-alphanumeric JavaScript without parentheses by abusing template literals and Array.prototype.find, building filter-evading XSS payloads that previously helped hack Uber.
- Published
- Collected