Gareth Heyes

In a shameless effort to promote my book. I've crafted some very special vectors for you. If you like them please purchase my book to read more. www.amazon.com/dp/B0BRD9B3GS

XSS from a response header 🤯 Firefox will load an XSLT stylesheet from a data: URL in a Link header. Combined with a harmless XML body and you get JS running in the page origin. Plus Safari importing GIFs as SVG and more sanitizer bypasses: portswigger.net/research/sca...

Whoo hoo random() now works in Chrome! My escape room puzzle solutions will now be randomized in Chrome. Just waiting for Firefox now.

Last night I finished a bunch of changes to make the Hackvertor UI more minimal. I removed the autodecode box and instead now you can just make a selection and autodecode the selection. Same features, less clutter. hackvertor.co.uk

Six consuming tags. One Safari trick: <select>. Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet: portswigger.net/web-security...

🎄 $13.37 for the JavaScript for hackers paperback on Amazon USA this Christmas. The perfect present for the JS hacker in your life (or for you). javascriptforhackers.co.uk#buy

Safari wanted a decryption key. AmirMSafari gave it alert(1). Two fresh XSS vectors using <audio>, <video> and onwebkitneedkey just landed in our PortSwigger XSS cheat sheet. He keeps finding gems. We keep adding them. portswigger.net/web-security...

Last night I updated Shazzer to improve the fuzz result toast. It's now more compact and you can see fuzz results for each browser in your personal network. shazzer.co.uk/vectors/6ab4...

Made a personal network in Shazzer so you can have all your logged in browsers connected so you can fuzz them all at once. Also added a fuzz basket feature so you can add a load of vectors to your personal fuzzing network. That was fun.

Another XSS vector for our cheat sheet, this time using <usermedia> Special mention to AmirMohammad Safari, who found this one and has contributed so many excellent vectors to the cheat sheet. portswigger.net/web-security...

Building on my research, my colleague Alex exfiltrated a 600-character hex token instantly using just background images and selectors. No recursive imports. portswigger.net/research/sma...

Chrome's new <microphone> tag has something to say: Another XSS vector for our cheat sheet, found by omidxrz. portswigger.net/web-security...

Chrome added a <camera> tag. omidxrz made it an XSS vector: Now in our XSS cheat sheet. portswigger.net/web-security...

Turbo Intruder 2 has landed! You can now surpass 100,000 RPS over WiFi using the new HTTP/3 engine, test HTTP/3 exclusive targets with the Burp adapter, and deploy new research-grade race condition techniques! Check out the post below for full details:

I've improved the sandbox in web Hackvertor to prevent tags from interfering with each other. For example if one tag executes first it used to be able to overwrite other functions like btoa. Fixed! <@encode(js)>btoa=()=>"pwnd"</@encode> <@encode(base64)>foobar</@encode>

I've released Burp Hackvertor v2.2.67. This version supports the check tag and expressions. You can read how to use them here: github.com/hackvertor/h... I'd love any feedback you have, let me know if the expressions are powerful enough.

I've added a super powerful feature to Hackvertor. Check tags.They let you perform expressions on tags <@check(isJson)>{"a":1}</@check> && <@encode(base64)>{"a":1}</@encode> The above example only returns base 64 encoded JSON if the first is valid JSON. thespanner.co.uk/hackvertor-c...

Did a small post about mutating Safari a behaviour that Shazzer found. thespanner.co.uk/mutating-saf...

Burp Hackvertor now has jigsaw mode too!

Just something I've been working on. Jigsaw mode in Hackvertor!

I've added a single execution type in Shazzer. This allows you to execute JS once. Useful for enumerating things in a browser such as events. Example vector: shazzer.co.uk/vectors/665a...

Safari actually supports CSS random! It's buggy but it does work. My escape room puzzles are now randomised on desktop and iPhone other browsers will follow

The coolest part of Shazzer is the fuzzing network. To reflect that I've updated the design and added animations. Now you can see swarms of browsers when they are connected shazzer.co.uk/network

Added a trophy room to my 3D world with what I think is my best work. Claude casually building 3D CSS like it's nothing...

I've made a major change to Shazzer. It will now collate historical fuzz result data. Previously to save costs it would remove older result data. I've since upgraded my db server. We should then have a history of interesting browser data. You can get RSS feeds of fuzz results too

Made the gallery a zig zag shape instead which fixes the performance glitches on Chrome. Check it out! garethheyes.co.uk

Fixed another collision bug. If you opened the doors you could walk through walls.

Yes do it 🥳

Fixed collision detection bugs on my website

My site now uses random() to randomize the solutions to the escape room. Random isn't available yet in any modern browser so it will fallback to a static solution.

Hehe my escape room even works on my iPhone 😂

With Claude I've created CSS/HTML only escape room puzzles on my website. Check it out! Absolutely no JS! Claude created the puzzles so it was quite fun trying to solve them myself 😀 garethheyes.co.uk

I 😻 Firefox

My presentation from OWASP AppSec '26 in Vienna is finally public. Watch me talk about XSS and XSS and Cross-Site Scripting, and XSS in this talk titled "The Devil Is In The Defaults: What To Do About XSS" youtube.com/watch?v=b7RlQdvPY3 (It's also about XSS).

You can now generate QR codes in web Hackvertor to share your URLs in presentations. Just click the QR code button.

I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: portswigger.net/research/css...

Did you know you can use HTTP header injection to trigger response queue poisoning and make it rain credentials? Learn how with the new @portswiggerres.bsky.social whitepaper "CRLF-Powered Desync Attacks: Beheading HTTP Streams" by @turtlesec.io and I. Read the full paper below 👇

@html5test.com I saw you're doom game :) you could probably do it in pure HTML/CSS. Check this out collision detection in CSS: thespanner.co.uk/pure-css-3d-...

If you want to see how to compromise an account from a paste and steal passwords in CSS and much more check out my paper "CSS: the bomb inside your inbox" 👇 portswigger.net/research/css...

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

Next week I'll present "Can AI Do Novel Security Research? Meet the HTTP Terminator" at @defcon.bsky.social & Black Hat USA! I'm really excited to share this one - got some spectacular outcomes from a wild research journey. See you there!

Come and see Tobia from @turtlesec.io and I at @blackhatevents.bsky.social and @defcon.bsky.social next week! We cannot wait to share what we've found!

I've wrote up how to do collision detection in pure CSS. I had loads of fun doing this. thespanner.co.uk/pure-css-3d-...