After using JavaScript for a while one of the worst parts I found was the String.replace function. When I realized it’s behaviour I thought to myself someone is going to use this wrong. The function itself is excellent, I use it all the time as you could probably tell with my code. It is far […]

One of the impossible problems of the web is how do you protect against site that has a persistent XSS hole yet requires JavaScript to function. I thought about this for a while and worked out you could create a XSS zone where you expect user input. Declaring a zone is tricky because if you […]

I set myself a fun challenge to create a vector that would execute in many contexts. The idea being that it should work regardless where it’s placed. For example:- “xss” ‘xss’ <tag alt=”xss”> As an added challenge I tried to execute only the one payload and where possible to use a single eval. I had […]

I discovered while reading some Firefox code that E4X allows you to call standard functions by using the special namespace. This is cool! We can now define setters etc on the XML prototype and call functions on E4X objects. It looks like this:- <></>.function::toString(); Would Firefox be crazy enough to include this special namespace on […]

Not posted for a while and you may have missed this on twitter. setTimeout(“MsgBox 1”,0,’VBS’); Cool so setTimeout supports vbscript as an argument. Yeah I can read MSDN 🙂 but JScript.Encode!!! Yet another place. I wonder what else remains undiscovered…. setTimeout(“#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@”,0,’JScript.Encode’); setInterval(“#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@”,0,’JScript.Encode’);