Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Edge XSS filter bypass

portswigger.net | research | #browser-security | #microsoft | #bypass | #edge | #xss-filter | #es6

Summary

Gareth Heyes explains an unfixed Edge XSS filter bypass combining a legacy IE location-object trick with ES6 computed property names to obfuscate toString/valueOf. Reported to Microsoft in 2015.
Published
Collected

original ↗

Related coverage

  1. Noscript XSS filter bypass (portswigger.net)
  2. What's in a tag name? JavaScript, apparently (portswigger.net)
  3. CSS:the bomb inside your inbox (portswigger.net)
  4. Using form hijacking to bypass CSP (portswigger.net)
  5. AngularJS CSP bypass in 56 characters (portswigger.net)
  6. Using Hackability to uncover a Chrome infoleak (portswigger.net)

back