I thought this was cool whilst experimenting, I found I could use hex decimal (ooops that’s what I get for posting on Monday morning) entities within a url to combine unicode strings to produce anything. The result is a truly obscure looking javascript, I’ve included a plain text alert to help understand what’s going on, […]

I’ve known about this technique for years but everyone might not be aware that Flash can be used for XSS, so I’ve decide to do a quick post to explain. Using getURL in Flash allows you to call javascript using the javascript protocol and using the parameter allowScriptAccess enables you to perform cross domain execution. […]