Bypassing AV with Veil-Evasion

Describes embedding a Base64 Meterpreter payload in an Office VBA macro so a legitimate emailed document can be re-sent as a backdoor after harvesting domain credentials.

A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.

Gareth Heyes executes non-alphanumeric JavaScript without parentheses by abusing template literals and Array.prototype.find, building filter-evading XSS payloads that previously helped hack Uber.

The XSS cheat sheet gains an 'impossible labs' section: eight scenarios its researchers couldn't exploit, from 15-character length limits to blocked events, with a challenge to solve the impossible.

Gareth Heyes adapts AngularJS template-injection payloads to bypass real-world filters: lower-case conversion at Piwik and a no-quotes policy at Uber. Both flaws enabled account hijacking.

A giant function with millions of instructions exposes quadratic behavior in LLVM's Global Dead Code Elimination pass, found while building an LLVM-based obfuscator; the post digs into the algorithm.