Gareth Heyes \u2028
@garethheyes
Followers
35K
Following
2K
Statuses
16K
JavaScript for hackers: Learn to think like a hacker. https://t.co/e0aNEbEDk5
javascript:
Joined October 2008
In case you missed it...the DEF CON video of my talk 'Splitting the Email Atom' is finally here! 🚀 Learn how to turn an email address into RCE on Joomla, bypass Zero Trust defences, and exploit parser discrepancies for misrouted emails.
2
23
79
RT @kevin_mizu: I'm very happy to finally share the second part of my DOMPurify security research 🔥 This article mostly focuses on DOMPuri…
0
99
0
RT @albinowax: Per popular demand, Turbo Intruder 1.51 now inserts results at the top of the table so you can watch them arrive without scr…
0
14
0
RT @angealbertini: We hexplored the basics of hash collisions and how they can be exploited, exploiting MD5 with Png, Gif, mp4 or Jpg, and…
0
17
0
RT @angealbertini: In the next livestream, we’ll extend file format tricks to cryptography and abuse hash collisions:
0
14
0
RT @leanpub: JavaScript for hackers by Gareth Heyes is on sale on Leanpub! Its suggested price is $35.00; get it for $14.00 with this coupo…
0
8
0
RT @d4d89704243: We've updated our URL validation bypass cheat sheet with this shiny Domain allow list bypass payload contributed by @dyak0…
0
61
0
RT @ruben_v_pina: form-action Content Security Policy Bypass This bypass can help you turn those unexploitable XSS bugs into exploitable v…
0
16
0
@RenwaX23 I didn't think there would be any difference that's why it wasn't included originally but based on feedback some users use Edge and not Chrome.
0
0
3
RT @PortSwiggerRes: The results are in! We're proud to announce the Top ten web hacking techniques of 2024!
0
277
0
RT @we1x: Building secure web apps shouldn't be a burden. We've built a high-assurance web framework at Google that makes security easy for…
0
14
0
@naugtur Ah I see yeah that would be easy detect. I guess the malware could show you down a different path if sandboxed but anyway really interesting stuff I might play with hardened JS myself
0
0
1
@naugtur How would you prevent time based obfuscation such as detecting paused execution e.g if over 500 ms has occurred between calls for example?
1
0
2
RT @thejsnation: 🎙️"Watch Me Run Malware From NPM" — Don’t miss this insightful talk by @naugtur! Watch the recording🍿
0
4
0