Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

Next week I'll present "Can AI Do Novel Security Research? Meet the HTTP Terminator" at @defcon.bsky.social & Black Hat USA! I'm really excited to share this one - got some spectacular outcomes from a wild research journey. See you there!

Come and see Tobia from @turtlesec.io and I at @blackhatevents.bsky.social and @defcon.bsky.social next week! We cannot wait to share what we've found!

I've wrote up how to do collision detection in pure CSS. I had loads of fun doing this. thespanner.co.uk/pure-css-3d-...

Fixed the teleports on my site. The burger menu now works on all browsers. I'd previously tried to get this working and failed. Opus just did it in about 5 mins. garethheyes.co.uk

Pure CSS first person 3D website portfolio without any JavaScript

This is website portfolio of Gareth Heyes

garethheyes.co.uk

My 3D world now has collision detection in CSS! If you run into a wall or door it will stop. Open the door and you can go through. This model is unbelievable. garethheyes.co.uk

I redesigned my website using Claude. I burned through a lot of tokens. I basically put all my research in a hallway and created a bookshelf of links. Yes I was up till 1am doing this 😂 it even works on the iPhone. No JS! garethheyes.co.uk

I haven't posted a crazy XSS vector for a while... Works on every browser

Both Hackvertor & Shazzer evolve the more you use them. It's such a shame they are not widely used and everyone is just using an LLM these days. That said I've found them both essential for conducting web security research.

Hackvertor evolves as you add tags. You're not just adding a new encoding, you're teaching the auto-decoder how to recognise and decode it too. Every custom tag makes Hackvertor smarter for future use. Read the tutorial to find out more... thespanner.co.uk/how-to-write...

You can now make a batch of private vectors public and assign them a collection in Shazzer. This is useful when presenting at a conference and you want to make a few public after the talk.

Messing around with inertia on my blog. Demo: thespanner.co.uk

I have a passion for 3D. I used to read 3D world magazine every month and the CD always contained trial software. I used to love messing around with 3D max and Poser. As I often do my interests pour into my research or projects. I made a 3D portfolio and a 3D tile blog. 1/2

I've added performance/feature vectors to Shazzer. Along with stats. You can now see which browsers perform better. It uses the same shared fuzzing network. shazzer.co.uk/stats/perfor...

Performance stats

An app to enable to fuzz all sorts of browser behaviour. Share your fuzz results with the world and discover new bugs!

shazzer.co.uk

On my lunch today I improve the Shazzer fuzz results toast. It looks really nice and can handle ranges easily.

Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead. shazzer.co.uk

I think this is the best most elegant XSS vector I've ever found

Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.

Just realized that one of my favorite easter eggs I made while at Stripe is still on the /jobs page… The monitor in the photo mimics everything you do on the page itself. 🥚💅 (only visible on Firefox because it uses an experimental feature)

Shazzer can now fuzz over 1 million characters now. I got Claude to refactor the fuzzing code and now it fuzzes in chunks. This is amazingly fast on Chromium based browsers because sandboxed iframes are process isolated. Firefox is pretty slow because it does not do this.

I wanted to see what Claude was capable of and I have a keen interest in football statistics. So I started a new side project called False 9, it was meant to take a few days to get some interesting stats. It escalated. I started off manually syncing from the data provider.

I've just added the coolest feature to Burp Hackvertor. Smart paste. If you have multiple encodings on your clipboard, you can use CMD+SHIFT+V and Hackvertor will convert all the data and wrap it with encoding tags 😎

Your Shazzer profile page now evolves the more public vectors you have. It changes colour, increases connected circles and your level changes. shazzer.co.uk/profile?id=6...

Shazzer - Shared online fuzzing

An app to enable to fuzz all sorts of browser behaviour. Share your fuzz results with the world and discover new bugs!

shazzer.co.uk

Good post!

Scott Helme@scotthelme.bsky.social · 2mo ago

Cookies are still one of the weakest links in Web security! Device Bound Session Credentials could change that. scotthelme.co.uk/device-bound...

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer! The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below: jorianwoltjer.com/blog/p/stori... (and thanks @garethheyes.co.uk for making Shazzer!)

Finding XSS on Shazzer (literally) | Jorian Woltjer

How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox malici...

jorianwoltjer.com

Gareth Heyes@garethheyes.co.uk · 2mo ago

Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...

Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

That’s a first: GitHub’s Advisory Database (incorrectly) flags Puppeteer as malware. github.com/github/advis... We are no longer able to publish new releases. Are there any GitHub or Microsoft folks here who can help escalate this?

False positives w.r.t. malware in Puppeteer: GHSA-grrc-v84p-qwv3 & GHSA-rvxm-vq55-8p53 · Issue #7684 · github/advisory-database

There seem to be two false positives that are affecting Puppeteer-related packages: @puppeteer/browsers is being flagged as malware in GHSA-grrc-v84p-qwv3. puppeteer-core is being flagged as malwar...

github.com

Allowed you to use Chrome's local AI model in Hackvertor tags. Warning it's very slow but should get better with time. You have to enable the local model in chrome://flags for it to work. hackvertor.co.uk/urls/33

Hackvertor - Cutting edge conversion

An app to make conversion tags to help with web security research

hackvertor.co.uk

Added AI features to Shazzer using Chrome's local model. They aren't very useful yet because the local model is very slow and isn't very smart but should improve over time when the model is updated. I've added: - AI write description - AI generate vector - AI generate variant