Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor.
https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
My 3D world now has collision detection in CSS! If you run into a wall or door it will stop. Open the door and you can go through. This model is unbelievable.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Both Hackvertor & Shazzer evolve the more you use them. It's such a shame they are not widely used and everyone is just using an LLM these days. That said I've found them both essential for conducting web security research.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
You can now make a batch of private vectors public and assign them a collection in Shazzer. This is useful when presenting at a conference and you want to make a few public after the talk.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Messing around with inertia on my blog.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I've added performance/feature vectors to Shazzer. Along with stats. You can now see which browsers perform better. It uses the same shared fuzzing network.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
On my lunch today I improve the Shazzer fuzz results toast. It looks really nice and can handle ranges easily.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I think this is the best most elegant XSS vector I've ever found. It still works in Safari. Here's the write up:
https://thespanner.co.uk/xssing-typeerrors-in-safari
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Shazzer can now fuzz over 1 million characters now. I got Claude to refactor the fuzzing code and now it fuzzes in chunks. This is amazingly fast on Chromium based browsers because sandboxed iframes are process isolated. Firefox is pretty slow because it does not do this.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat!
Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read:
https://blackhat.com/us-26/briefings/schedule/index.html#css-the-bomb-inside-your-inbox-51909
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Allowed you to use Chrome's local AI model in Hackvertor tags. Warning it's very slow but should get better with time. You have to enable the local model in chrome://flags for it to work.
https://hackvertor.co.uk/urls/33
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Added AI features to Shazzer using Chrome's local model. They aren't very useful yet because the local model is very slow and isn't very smart but should improve over time when the model is updated. I've added:
- AI write description
- AI generate vector
- AI generate variant
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I broke Shazzer, should be fixed now
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
After extensive testing with more generic versions, I decided to make browser version numbers more accurate now in Shazzer. This will create more fuzz data but will be more useful to test quirks in browsers. I've also hid older browser versions by default and provide filtering.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Shazzer is now a social network. You can post messages, links and vectors. Let's build and break it together and create a true web security social network.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations and has the option for twitter too.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
String.fromCharCode overflows. I didn't know how this worked many years ago. Now it seems so simple. The maximum value a character can be generated is 0xffff. So if you want to generate A (0x41) you simply add one to the max value plus the character you want to generate.
0x10000 is 0xffff+1. So to generate A you do:
String.fromCharCode(0x10000 + 0x41)//A
All this is explained in:
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
If you haven't tried Shazzer yet you should give it a go. You can easily find browser behaviour and get it tested by other users or your team. It supports private vectors too and you can assign them to your team. You can even have your own private fuzzing network. 🔥🔥🔥
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Shazzer & Hackvertor OAuth was broken because of a Github change. Hopefully I've fixed the issues now.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I improved the collection view in Shazzer. You can now expand the results below the vector.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Shazzer had an interesting bug. I write to a blob URL thats sandboxed but because its a blob URL it breaks relative URLs which means vectors with them would return false negatives. The fix was: use a base tag to change the domain. This fixes vectors like:
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Been doing a lot of statistical analysis in my free time on yet another side project. It's quite fun and far less challenging than my other side projects.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
You can now create collections of vectors on Shazzer. You can select up to 10 vectors and view the results of each by clicking a button. If anyone has any ideas to display the results in a better way let me know.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Last night I added GZip and Deflate compression to Hackvertor. I also improved the autodecoder to detect it. Yesterday on my lunch I added autocompletion for HackPad and fixed a bunch of bugs.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Hackvertor v2.2.45 released!
Fixed UI, primary buttons now have primary colour
Websocket message editor (Big thanks snooze6)
Hex edit functionality (Big thanks snooze6)
Centred dialogs (Big thanks psalire)
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Question is what do I build next? So exciting. So many ideas...
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I've got to the point where I've implemented nearly every 1 of my ideas for Shazzer and Hackvertor. Claude played a big part in that. I'm proud of them both. My approach of semi-vibing was long winded but now I think it's really paid off in both knowledge and speed of development
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I've added tool tips to the tags in Hackvertor!
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Last night I made web Hackvertor more beautiful. I followed the same process I did with Shazzer. The footer is cleaned up and the nav bar now remembers the section and is reorganized.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
I've added a modal dialog to confirm if you want to opt in to Shared fuzzing in Shazzer. If you've already made a choice it should not show. Sorry about the dialog they are annoying but necessary in this case.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
New geolocation-based XSS vectors just landed in our XSS cheat sheet. Huge thanks to AmirMohammad Safari for the great submission.
https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#onpromptaction
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Last night I fixed Hackvertor history to work when real time is enabled. I made the collapsable panels remember their state. Various UI fixes. In Shazzer I fixed the like count on the vector card.
Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook https://leanpub.com/javascriptforhackers/
Did huge amounts of updates to Shazzer. The fuzzing network was particularly tricky. I had production issues but hopefully I've fixed them. You can now visually see the fuzzing network at:
