Web Hacking → XSS & Client-Side
An Electron app is a web page wearing a native costume — Chromium on top, full Node.js underneath. When the two layers are fused t…
The sandbox attribute is the browser’s built-in jail for untrusted HTML — it strips scripts, origin, forms, popups, …
Two bug classes that slip past sanitizers without ever using a script tag. DOM clobbering shadows JavaScript globals via named HTM…
How a single HTTP header decides whether your XSS becomes a footnote or a CVE. A deep walk through CSP1/2/3 grammar, nonce and has…
How cross-site request forgery actually works in the browser, why the SameSite cookie attribute changed everything, the four class…
The web's single most important security boundary explained — what an origin is, what SOP blocks, how CORS unlocks cross-origin re…
Advanced DOM attack techniques — DOM clobbering to bypass sanitizers, mXSS DOMPurify bypass, AngularJS sandbox escape payloads, CS…
Advanced CSP bypass methodology — JSONP endpoint abuse, CDN bypass, AngularJS ng-app escapes for every version, strict-dynamic byp…
Complete guide to CSWSH WebSocket hijacking, Service Worker C2 channels, browser extension vulnerabilities, CORS exploitation, and…
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealing, keyloggers, BeEF framework, XSS-to-RC…