I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: portswigger.net/research/css...

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

I redesigned my website using Claude. I burned through a lot of tokens. I basically put all my research in a hallway and created a bookshelf of links. Yes I was up till 1am doing this 😂 it even works on the iPhone. No JS! garethheyes.co.uk

I haven't posted a crazy XSS vector for a while... Works on every browser

Messing around with inertia on my blog. Demo: thespanner.co.uk

Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead. shazzer.co.uk

I think this is the best most elegant XSS vector I've ever found

Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations. hackvertor.co.uk/snippet

I've added tool tips to the tags in Hackvertor!

New geolocation-based XSS vectors just landed in our XSS cheat sheet. Huge thanks to AmirMohammad Safari for the great submission. portswigger.net/web-security...

Massive update to Hackvertor - Syntax highlighting - Code editors - New auto decode box - Tag and code completion - Brand new auto decoder

Made Shazzer even more beautiful I took inspiration from F1.

We've just hit a very important milestone - our XSS Cheat Sheet now has 1337 vectors! Browse them here: portswigger.net/web-security...

Been experimenting with AI to produce 3D effects. Here as you scroll the tiles rotate into place.

I meant to have a break from the computer on my day off...but I couldn't resist. I've updated my blog with cool effects!

Bypass CSP in a single click using my new Custom Action, powered by @renniepak.nl's excellent CSP bypass project.

Burp Hackvertor has a bunch of new shortcuts and functionality. Try them out in Burp. They are activated from a Burp repeater request.

Hackvertor 2.2.33 released! - New MultiEncoder window (CTRL+ALT+M) for applying multiple transformations across layers and sending to Repeater tab - WebSockets support including a WebSocket handler and a new WebSocket setting - Improved auto decoding

Demo of the new Shadow Repeater response timing differences.

Coming to Hackvertor soon... Big thanks to CoreyD97 for the suggestion!

New Safari vector: Instead of using window name, I use document.URL to smuggle the payload and the title attribute to create the TypeError XSS. Hash: #'-alert(1)// Poc: portswigger-labs.net/xss/xss.php?...

If you want to learn how to construct epic payloads like this? You need JavaScript for Hackers. Requires this hash: #<img/src/onerror=alert(1)> www.amazon.com/JavaScript-h...

Want to learn how to craft payloads like these? Read JavaScript for Hackers to master creative XSS techniques and understand exactly why they work. 🧠 Learn to think like a hacker ⚡ Master the art of payload design Grab your copy 👉 www.amazon.com/JavaScript-h...

Last chance to catch "Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls" at the NDC Conference, Manchester. Join me and see just how wild the email RFCs really are. portswigger.net/research/tal...

In a shameless effort to promote my book. I've crafted some very special vectors for you. If you like them please purchase my book to read more. www.amazon.com/dp/B0BRD9B3GS

Wrote a old school toString obfuscator. hackvertor.co.uk/urls/26

WAFs still blocking your payloads? Try our newest pointer capture tricks. Our XSS cheat sheet just got an upgrade thanks to Muhammad Ahsan. portswigger.net/web-security...

Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission. portswigger.net/web-security...