PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp Clickbandit: A JavaScript based clickjacking PoC generator

portswigger.net | research | #burp-suite | #poc | #javascript | #clickjacking | #tool
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PortSwigger releases Burp Clickbandit, a pure-JavaScript point-and-click tool that generates clickjacking proof-of-concept attacks, including multi-click attacks, directly from within Burp.
Published
Collected

Related coverage

research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
tool · github.com
Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript
Streamlines JavaScript reconnaissance during bug bounty hunting and web penetration testing by uncovering hidden attack surfaces and exposed secrets with minimal noise.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Bypassing WAFs and cracking XOR with Hackvertor
Gareth Heyes showcases Hackvertor's tag-based encoding for chaining multiple conversion layers inside Burp requests, demonstrating a Cloudflare WAF bypass and XOR cracking.
Back