0x999 🇮🇱

New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking-i…

This vector adds an onerror handler with eval, rewrites all ReferenceError names, then triggers an error to execute the payload. Just added it to the XSS cheat sheet. Credit to @_0x999, inspired by @terjanq. Link to vector👇

Crafty JavaScript-context XSS vector using ondevicemotion, setTimeout, and URIError spoofing to trigger alert(1) now added to the XSS cheat sheet. By @_0x999 inspired by @terjanq. Link to vector👇

Unicode characters with a decomposition of 2+ ASCII characters and are registrable domains by @_0x999 shazzer.co.uk/vectors/681bdf…

Here is my author's writeup for Intigriti's March 0325 CTF challenge, Thanks to everyone who participated & great job by all the solvers! 🔥 0x999.net/blog/intigriti…

This month, @_0x999 made an awesome and difficult Intigriti XSS challenge. I really enjoyed the openness of this challenge resulting in an unintended solution and the first solve 🩸! Check out how I got there in my writeup below: jorianwoltjer.com/blog/p/hacking…

My blog post, "Exploring Javascript Events & Bypassing WAFs via Character Normalization" has been nominated for the Top 10 Web Hacking Techniques of 2024!☺️ If you found it useful, I’d greatly appreciate your vote at the link below 👇 portswigger.net/polls/top-10-w…

Very cool technique by @lukejahnke for POST based CSRF without a content-type header using a Blob object, Interestingly it also seems to work using a Uint8Array

Surprisingly no one was able to solve the challenge so far🥲 Check it out if you have time and haven’t already👇

Just finished reading #javascriptforhackers by @garethheyes , learned lots of new tricks, if you’re interested in javascript I highly recommend buying a copy

Yay, I was awarded a $1,575 + $457 bounty on @Hacker0x01! hackerone.com/0x999 #TogetherWeHitHarder Thanks to @garethheyes for the awesome research!

The single-packet attack strikes again! Awesome finding from @_0x999 - check his reply for details and a near-identical @WebSecAcademy lab!