Archives for the Month of April, 2009

Overwriting native functions in javascript

I research a lot of Javascript as part of my job and I’ve been toying with the idea of a perfect native function overwrite. The idea is that you can still call the native function and have control over it but once it’s been defined it cannot be modified only destroyed. My idea was to […]


I like this event, it’s pretty cool. The reason why it’s interesting from a XSS perspective is that it is executed automatically without user interaction. This is rare in the XSS playground, usually you have to use onerror, onload or onfocus events and they only work in certain circumstances. I’d better mention that the event […]

Cross browser javascript sandbox

I think I’ve managed to create a good sandboxing system using same origin policy. The only downside is that it uses new windows to prevent top.location assignments. It works by injecting code into another domain ( and executing the code in the context of that domain and returning the result of the code in the […]