PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Edge XSS filter bypass

portswigger.net | research | #browser-security | #microsoft | #bypass | #edge | #xss-filter | #es6
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes explains an unfixed Edge XSS filter bypass combining a legacy IE location-object trick with ES6 computed property names to obfuscate toString/valueOf. Reported to Microsoft in 2015.
Published
Collected

Related coverage

research · portswigger.net
Noscript XSS filter bypass
Gareth Heyes finds a NoScript XSS filter bypass using __defineSetter__ to trigger arbitrary function calls in script context, with window.name delivery across domains. Since patched.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Using form hijacking to bypass CSP
Form hijacking bypasses CSP via injected forms or formaction attributes while password managers auto-fill credentials. Seen on Infosec Mastodon and PortSwigger's site; Burp added passive scan checks.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
Back