You can now generate QR codes in web Hackvertor to share your URLs in presentations. Just click the QR code button.

I stole an Outlook password with nothing but CSS inside an email 👀

Whitepaper below 👇

This video is from my research "CSS: the bomb inside your inbox".
Whitepaper & slides:
https://portswigger.net/research/css-the-bomb-inside-your-inbox

If you want to see how to compromise an account from a paste and steal passwords in CSS and much more check out my paper "CSS: the bomb inside your inbox" 👇

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

I've wrote up how to do collision detection in pure CSS. I had loads of fun doing this.

https://thespanner.co.uk/pure-css-3d-world-collision-detection

Fixed the teleports on my site. The burger menu now works on all browsers. I'd previously tried to get this working and failed. Opus just did it in about 5 mins.

https://garethheyes.co.uk/

My 3D world now has collision detection in CSS! If you run into a wall or door it will stop. Open the door and you can go through. This model is unbelievable.

https://garethheyes.co.uk/

I redesigned my website using Claude. I burned through a lot of tokens. I basically put all my research in a hallway and created a bookshelf of links. Yes I was up till 1am doing this 😂 it even works on the iPhone. No JS!

https://garethheyes.co.uk/

I haven't posted a crazy XSS vector for a while...

Works on every browser

https://portswigger-labs.net/xss/xss.php?x=%3Calert(1)%20onfocus=%22attributes[0].value=localName,new%20onfocus%22%20autofocus%20tabindex=1%3E

Both Hackvertor & Shazzer evolve the more you use them. It's such a shame they are not widely used and everyone is just using an LLM these days. That said I've found them both essential for conducting web security research.

Hackvertor evolves as you add tags. You're not just adding a new encoding, you're teaching the auto-decoder how to recognise and decode it too. Every custom tag makes Hackvertor smarter for future use.

Read the tutorial to find out more...

https://thespanner.co.uk/how-to-write-a-hackvertor-tag

You can now make a batch of private vectors public and assign them a collection in Shazzer. This is useful when presenting at a conference and you want to make a few public after the talk.

Messing around with inertia on my blog.

Demo:
https://thespanner.co.uk/

I have a passion for 3D. I used to read 3D world magazine every month and the CD always contained trial software. I used to love messing around with 3D max and Poser. As I often do my interests pour into my research or projects. I made a 3D portfolio and a 3D tile blog.

Check them out:

3D portfolio:
https://garethheyes.co.uk/

3D tile blog:
https://thespanner.co.uk/

I've added performance/feature vectors to Shazzer. Along with stats. You can now see which browsers perform better. It uses the same shared fuzzing network.

https://shazzer.co.uk/stats/performance

On my lunch today I improve the Shazzer fuzz results toast. It looks really nice and can handle ranges easily.

Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead.

https://shazzer.co.uk/

I think this is the best most elegant XSS vector I've ever found. It still works in Safari. Here's the write up:
https://thespanner.co.uk/xssing-typeerrors-in-safari

Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.

Shazzer can now fuzz over 1 million characters now. I got Claude to refactor the fuzzing code and now it fuzzes in chunks. This is amazingly fast on Chromium based browsers because sandboxed iframes are process isolated. Firefox is pretty slow because it does not do this.