Controls

Mac

Ctrl+Alt+W
Up
Ctrl+Alt+A
Left (face west)
Ctrl+Alt+D
Right (face east)
Ctrl+Alt+S
Down
Ctrl+Alt+X
Stop

Windows

Shift+Alt+W
Up
Shift+Alt+A
Left (face west)
Shift+Alt+D
Right (face east)
Shift+Alt+S
Down
Shift+Alt+X
Stop

Movement speed

Gareth Heyes

Gareth Heyes is a PortSwigger web security researcher best known for pioneering research into cross site scripting, particularly DOM based XSS, and for discovering novel filter bypass and payload techniques. His work has significantly shaped modern client side vulnerability detection and exploitation. He is the author of the book "JavaScript for Hackers" and PortSwigger’s XSS Cheat Sheet.

At PortSwigger, Gareth spends his time researching new techniques for attacking web applications and inventing ever more creative XSS vectors. He has a particular fascination with abusing CSS in unconventional ways, from pure CSS 3D rooms and games to pushing markup languages well beyond their intended limits on his website. In his spare time, he enjoys building Burp Suite extensions, including the widely used Hackvertor.

Inspiration

The lockbox

Three mechanisms hold the lid. Every figure you need is struck, chalked or engraved somewhere in these rooms — the Cipher ledger on the bookcase explains the mechanisms.

I The pans

Hang brass weights on the pan until the beam reads the engraved figure. Something in this room is engraved too small to read with the naked eye.

Pans read

II The hex dials

Three dials, one hexadecimal digit each. The pairs are etched on a plate in this room; what to do with each pair is in the ledger.

III The seal keypad

Four brass seals are struck around the rooms — two in the entrance hall, two in here. Set the tumblers to their digits, I to IV.

The lid holds fast.The hasp springs. Close this and lift the lid.

Cipher

Notes on the lockbox in the corner. Three mechanisms, all of them stupid, none of them mine.

The pans

The target weight is engraved on the balance itself, in figures far too small for anyone but a jeweller. A glass hangs on the wall you had your back to as you walked in.

The dials

The plate by the window gives three pairs of hex digits. Each dial takes one pair, folded together:

  • Dial 1 — the pair
  • Dial 2 — the pair
  • Dial 3 — the pair

The seals

Four brass seals, numbered I–IV, each struck with one digit. Read them in order and set the four tumblers to match.

Two are in the entrance hall: one under the graffiti, one on the gallery door. Two are in here: one on the window frame, one at the foot of this bookcase.

Bit-fiddling, for the rusty

01
XORsame → 0different → 1
AND1 only where both bits are 1
OR1 where either bit is 1
Profile
LinkedIn Twitter Mastodon Bluesky GitHub Blog PortSwigger research Email
Contact
DOM Invader Hackvertor website Hackvertor BApp Shazzer website Taborator BApp SSPP Scanner XSS cheat sheet XSS labs
Tools
XSS for PDFs DOM sandbox escapes JSON hijacking Unknown browsers XSS horror show Non-alpha JS/PHP Splitting the email atom
Talks
Inspiration
JS for hackers · paperback JS for hackers · ebook Web App Obfuscation
Books
IV
I
JS
No JavaScript
Pure HTML + CSS
III
JavaScript for hackers: Learn to think like a hacker, by Gareth Heyes
Dial pairs 1 2 3
Balance no. 3 — load pans to 0x
Splitting the email atom: exploiting parsers to bypass access controlsSplitting the email atom: exploiting parsers to bypass access controls2024 CSS:the bomb inside your inboxCSS:the bomb inside your inbox2026 RPORPO2014 DOM ClobberingDOM Clobbering2013
JavaScript for hackersJavaScript for hackers CSS:the bomb inside your inboxCSS:the bomb inside your inbox2026
What's in a tag name? JavaScript, apparentlyWhat's in a tag name? JavaScript, apparently2026 Pure-CSS 3D world collision detectionPure-CSS 3D world collision detection2026
How to write a Hackvertor tagHow to write a Hackvertor tag2026 Speedy RSVP extensionSpeedy RSVP extension2026
Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsIntroducing Feedworm: A Privacy-First RSS Reader That Lives in DevTools2026 AutoVaderAutoVader2025
Hackvertor history and tag finderHackvertor history and tag finder2025 Burp Hackvertor v2.1.24 releaseBurp Hackvertor v2.1.24 release2025
Shadow Repeater v1.2.3 releaseShadow Repeater v1.2.3 release2025 Inline Style Exfiltration: leaking data with chained CSS conditionalsInline Style Exfiltration: leaking data with chained CSS conditionals2025
Repeater Strike: manual testing, amplifiedRepeater Strike: manual testing, amplified2025 XSSing TypeErrors in SafariXSSing TypeErrors in Safari2025
Hacking roomsHacking rooms2025 valueOf: Another way to get thisvalueOf: Another way to get this2025
Making the Unexploitable Exploitable with X-Mixed-Replace on FirefoxMaking the Unexploitable Exploitable with X-Mixed-Replace on Firefox2025 Document My Pentest: you hack, the AI writes it up!Document My Pentest: you hack, the AI writes it up!2025
The curious case of the evt parameterThe curious case of the evt parameter2025 CSS-Only Tic Tac Toe ChallengeCSS-Only Tic Tac Toe Challenge2025
SAML roulette: the hacker always winsSAML roulette: the hacker always wins2025 Bypassing character blocklists with unicode overflowsBypassing character blocklists with unicode overflows2025
Shadow Repeater:AI-enhanced manual testingShadow Repeater:AI-enhanced manual testing2025 Concealing payloads in URL credentialsConcealing payloads in URL credentials2024
Splitting the email atom: exploiting parsers to bypass access controlsSplitting the email atom: exploiting parsers to bypass access controls2024 Using form hijacking to bypass CSPUsing form hijacking to bypass CSP2024
onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheetonwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet2024 Hiding payloads in Java source code stringsHiding payloads in Java source code strings2024
Blind CSS Exfiltration: exfiltrate unknown web pagesBlind CSS Exfiltration: exfiltrate unknown web pages2023 Bypassing CSP via DOM clobberingBypassing CSP via DOM clobbering2023
Exploiting XSS in hidden inputs and meta tagsExploiting XSS in hidden inputs and meta tags2023 Ambushed by AngularJS: a hidden CSP bypass in Piwik PROAmbushed by AngularJS: a hidden CSP bypass in Piwik PRO2023
Exploiting prototype pollution in Node without the filesystemExploiting prototype pollution in Node without the filesystem2023 Hijacking service workers via DOM ClobberingHijacking service workers via DOM Clobbering2022
Server-side prototype pollution: Black-box detection without the DoSServer-side prototype pollution: Black-box detection without the DoS2023 Stealing passwords from infosec Mastodon - without bypassing CSPStealing passwords from infosec Mastodon - without bypassing CSP2022
Detecting web message misconfigurations for cross-domain credential theftDetecting web message misconfigurations for cross-domain credential theft2022 Our favourite community contributions to the XSS cheat sheetOur favourite community contributions to the XSS cheat sheet2022
Safari is hot-linking images to semi-random websitesSafari is hot-linking images to semi-random websites2022 The seventh way to call a JavaScript function without parenthesesThe seventh way to call a JavaScript function without parentheses2022
Using Hackability to uncover a Chrome infoleakUsing Hackability to uncover a Chrome infoleak2022 Bypassing Firefox's HTML Sanitizer APIBypassing Firefox's HTML Sanitizer API2022
Framing without iframesFraming without iframes2022 Widespread prototype pollution gadgetsWidespread prototype pollution gadgets2022
Bypassing CSP with dangling iframesBypassing CSP with dangling iframes2022 uBlock, I exfiltrate: exploiting ad blockers with CSSuBlock, I exfiltrate: exploiting ad blockers with CSS2021
New XSS vectorsNew XSS vectors2022 Creating a 3D world in pure CSSCreating a 3D world in pure CSS2021
Hunting nonce-based CSP bypasses with dynamic analysisHunting nonce-based CSP bypasses with dynamic analysis2021 Portable Data exFiltration: XSS for PDFsPortable Data exFiltration: XSS for PDFs2020
Finding DOM Polyglot XSS in PayPal the Easy WayFinding DOM Polyglot XSS in PayPal the Easy Way2021 Evading defences using VueJS script gadgetsEvading defences using VueJS script gadgets2020
Bypassing DOMPurify again with mutation XSSBypassing DOMPurify again with mutation XSS2020 Attacking and defending JavaScript sandboxesAttacking and defending JavaScript sandboxes2020
When alert fails: exploiting transient eventsWhen alert fails: exploiting transient events2020 Escaping JavaScript sandboxes with parsing issuesEscaping JavaScript sandboxes with parsing issues2020
Documenting the impossible: Unexploitable XSS labsDocumenting the impossible: Unexploitable XSS labs2020 DOM Clobbering strikes backDOM Clobbering strikes back2020
JavaScript without parentheses using DOMMatrixJavaScript without parentheses using DOMMatrix2020 SVG animate XSS vectorSVG animate XSS vector2020
XS-Leak: Detecting IDs using PortalXS-Leak: Detecting IDs using Portal2019 AngularJS CSP bypass in 56 charactersAngularJS CSP bypass in 56 characters2019
Bypassing AngularJS bind HTMLBypassing AngularJS bind HTML2019 XS-Leak: Leaking IDs using focusXS-Leak: Leaking IDs using focus2019
One XSS cheatsheet to rule them allOne XSS cheatsheet to rule them all2019 Provoking browser quirks with behavioural fuzzingProvoking browser quirks with behavioural fuzzing2019
Bypassing CSP with policy injectionBypassing CSP with policy injection2019 Abusing jQuery for CSS powered timing attacksAbusing jQuery for CSS powered timing attacks2019
XSS without parentheses and semi-colonsXSS without parentheses and semi-colons2019 Bypassing WAFs and cracking XOR with HackvertorBypassing WAFs and cracking XOR with Hackvertor2018
Exposing Intranets with reliable Browser-based Port scanningExposing Intranets with reliable Browser-based Port scanning2018 Rewriting relative urls with the base tag in SafariRewriting relative urls with the base tag in Safari2018
Bypassing DOMPurify with mXSSBypassing DOMPurify with mXSS2018 Hackability inspectorHackability inspector2018
Evading CSP with DOM-based dangling markupEvading CSP with DOM-based dangling markup2018 Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzingUnearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing2018
Abusing JavaScript frameworks to bypass XSS mitigationsAbusing JavaScript frameworks to bypass XSS mitigations2017 RCE in JXBrowser JavaScript/Java bridgeRCE in JXBrowser JavaScript/Java bridge2016
DOM based AngularJS sandbox escapesDOM based AngularJS sandbox escapes2017 Bypassing CSP using polyglot JPEGsBypassing CSP using polyglot JPEGs2016
JSON hijacking for the modern webJSON hijacking for the modern web2016 Adapting AngularJS payloads to exploit real world applicationsAdapting AngularJS payloads to exploit real world applications2016
Executing non-alphanumeric JavaScript without parenthesisExecuting non-alphanumeric JavaScript without parenthesis2016 Edge XSS filter bypassEdge XSS filter bypass2016
XSS without HTML: Client-Side Template Injection with AngularJSXSS without HTML: Client-Side Template Injection with AngularJS2016 XSS in hidden input fieldsXSS in hidden input fields2015
Burp Clickbandit: A JavaScript based clickjacking PoC generatorBurp Clickbandit: A JavaScript based clickjacking PoC generator2015 Abusing Chrome's XSS auditor to steal tokensAbusing Chrome's XSS auditor to steal tokens2015
Noscript XSS filter bypassNoscript XSS filter bypass2015 How I smashed MentalJSHow I smashed MentalJS2015
New IE mutation vectorNew IE mutation vector2015 MentalJS DOM bypassMentalJS DOM bypass2015
Another XSS auditor bypassAnother XSS auditor bypass2015 Bypassing the IE XSS filterBypassing the IE XSS filter2015
XSS Auditor bypassXSS Auditor bypass2015 Unbreakable filterUnbreakable filter2014
MentalJS bypassesMentalJS bypasses2014 Java SerializationJava Serialization2014
mXSSmXSS2014 Bypassing the XSS filter using function reassignmentBypassing the XSS filter using function reassignment2014
RPORPO2014 X-Domain scroll detection on IE using focusX-Domain scroll detection on IE using focus2013
Sandboxed jQuerySandboxed jQuery2014 Epic fail IEEpic fail IE2013
new operatornew operator2013 Hacking FirefoxHacking Firefox2013
Decoding complex non-alphanumeric JavaScriptDecoding complex non-alphanumeric JavaScript2013 DOM ClobberingDOM Clobbering2013
Bypassing XSS AuditorBypassing XSS Auditor2013 Non-Alpha PHP in 6-7 charsetNon-Alpha PHP in 6-7 charset2012
The evolution of codeThe evolution of code2013 Tweetable PHP-Non AlphaTweetable PHP-Non Alpha2012
MentalJS for PHPMentalJS for PHP2012 Sandboxing and parsing jQuery in 100msSandboxing and parsing jQuery in 100ms2012
Opera x domain with video tutorialOpera x domain with video tutorial2012 MentalJS Sandbox/ParserMentalJS Sandbox/Parser2012
Firefox knows what your friends did last summerFirefox knows what your friends did last summer2012 Caja hackingCaja hacking2012
Hacking caja part 2Hacking caja part 22012 PHP nonalpha tutorialPHP nonalpha tutorial2012
Multi-context XSS injection contestMulti-context XSS injection contest2012 PngfixPngfix2012
Code mutation experimentsCode mutation experiments2012 Unicode rendering errorsUnicode rendering errors2012
JSLRJSLR2012 XSS technique without parenthesesXSS technique without parentheses2012
Eval a urlEval a url2012 RIPS static source code analyserRIPS static source code analyser2012
Data enumeration tutorial in ShazzerData enumeration tutorial in Shazzer2012 Breaking feedsBreaking feeds2012
Introducing Shazzer: A shared online fuzzerIntroducing Shazzer: A shared online fuzzer2012 HTML scriptless attacksHTML scriptless attacks2011
NULLs in entities in FirefoxNULLs in entities in Firefox2011 Non-alpha JavaScript and PHP slidesNon-alpha JavaScript and PHP slides2011
staticHTML propertystaticHTML property2011 We need @ urlsWe need @ urls2011
Non alphanumeric code in PHPNon alphanumeric code in PHP2011 PHP CSSRegPHP CSSReg2011
Protecting against XSSProtecting against XSS2011 Unicode monster is back this time eating chromeUnicode monster is back this time eating chrome2011
Decoding non-alphanumeric code with HackvertorDecoding non-alphanumeric code with Hackvertor2011 JSReg down but not outJSReg down but not out2011
The JSON specification is now wrongThe JSON specification is now wrong2011 JSON HijackingJSON Hijacking2011
Opera parser monster eats unicodeOpera parser monster eats unicode2011 Blog fight round twoBlog fight round two2011
DOM sandboxing talkDOM sandboxing talk2011 Regex HTML Sanitisation can workRegex HTML Sanitisation can work2011
Hackvertor supports 0AuthHackvertor supports 0Auth2011 Hackvertor export APIHackvertor export API2011
How do you spell JavaScript again?How do you spell JavaScript again?2011 XSS Rays extensionXSS Rays extension2011
Jump off a bridge specificationJump off a bridge specification2011 Breaking HTML parsers for funBreaking HTML parsers for fun2010
Late meta Christmas presentLate meta Christmas present2010 JSReg bypassesJSReg bypasses2010
Preventing social network wormsPreventing social network worms2010 String replace JavaScript bad designString replace JavaScript bad design2010
New Hackvertor upgradeNew Hackvertor upgrade2010 XSS ZonesXSS Zones2010
One vector to rule them allOne vector to rule them all2010 setTimeout and setIntervalsetTimeout and setInterval2010
Function is the new windowFunction is the new window2010 Setters using VBS and constant hacksSetters using VBS and constant hacks2010
Sandboxed DOM APISandboxed DOM API2010 Can all mozilla people look away now pleaseCan all mozilla people look away now please2010
Astalanumerator 0.7Astalanumerator 0.72010 Hackvertor Ajax applicationsHackvertor Ajax applications2010
Regular expression sandboxingRegular expression sandboxing2010 DOM CSS fight at the O.K. CorralDOM CSS fight at the O.K. Corral2010
Month of PHP securityMonth of PHP security2010 HTMLRegHTMLReg2010
Astalanumerator updateAstalanumerator update2010 Writing Hackvertor tagsWriting Hackvertor tags2010
Solving the secret question problemSolving the secret question problem2010 Hackvertor APIHackvertor API2010
Hackvertor and JSRegHackvertor and JSReg2010 The safety netThe safety net2010
My RegExp is still leakingMy RegExp is still leaking2010 Facebook sandbox escapeFacebook sandbox escape2010
HTML5 new XSS vectorsHTML5 new XSS vectors2009 Twitter misidentifying contextTwitter misidentifying context2009
Ping pong obfuscationPing pong obfuscation2009 Bypassing CSP for fun, no profitBypassing CSP for fun, no profit2009
My RegExp is leakingMy RegExp is leaking2009 Javascript compression with unicode charactersJavascript compression with unicode characters2009
PHP self return of the slashPHP self return of the slash2009 Fresh prototypes on all browsersFresh prototypes on all browsers2009
Creating HTML listeners with JSReg and HackvertorCreating HTML listeners with JSReg and Hackvertor2009 Hidden Firefox properties revisitedHidden Firefox properties revisited2009
JSReg updateJSReg update2009 New beta of JSRegNew beta of JSReg2009
CSP - Mozilla content security policyCSP - Mozilla content security policy2009 Asta la vista babyAsta la vista baby2009
Minor Safari cross domain bugMinor Safari cross domain bug2009 New PHPIDS vectorNew PHPIDS vector2009
Astalanumerator babyAstalanumerator baby2009 Three-Strikes and you're DOSdThree-Strikes and you're DOSd2009
Hackvertor obfuscated code tutorialHackvertor obfuscated code tutorial2009 Opera XSS vectorsOpera XSS vectors2009
Overwriting native functions in javascriptOverwriting native functions in javascript2009 Cross browser javascript sandboxCross browser javascript sandbox2009
onreadystatechangeonreadystatechange2009 XSS RaysXSS Rays2009
HTML5 XSSHTML5 XSS2009 Inline UTF-7 E4X javascript hijackingInline UTF-7 E4X javascript hijacking2009
Hackvertor now translatesHackvertor now translates2009 Javascript unique strings with RegExpsJavascript unique strings with RegExps2009
Detecting browsers javascript hacksDetecting browsers javascript hacks2009 JSReg javascript parserJSReg javascript parser2009
Detecting IE in 12 bytesDetecting IE in 12 bytes2009 Hackvertor now decodes css escapesHackvertor now decodes css escapes2009
Sliceya CAPTCHASliceya CAPTCHA2009 Calling the Array constructor in IECalling the Array constructor in IE2009
Crazy javascriptCrazy javascript2009 I know what your friends did last summerI know what your friends did last summer2009
PHPIDS bypassPHPIDS bypass2009 IP conversionIP conversion2008
Location based XSS attacksLocation based XSS attacks2008 Javascript vbscript challengeJavascript vbscript challenge2008
Hackvertor and clickjackingHackvertor and clickjacking2008 BluehatBluehat2008
Wordpress plugin securityWordpress plugin security2008 To infinity and beyond!To infinity and beyond!2008
Javascript protocol fuzzer and OperaJavascript protocol fuzzer and Opera2008 E4X for hackersE4X for hackers2008
XSS is artXSS is art2008 New XSS vectorNew XSS vector2008
CSS overlays and frame breakersCSS overlays and frame breakers2008 Hackvertor discussionHackvertor discussion2008
Strings to arrayStrings to array2008 Javascript protocol fuzz resultsJavascript protocol fuzz results2008
Javascript protocol fuzzerJavascript protocol fuzzer2008 Firefox applet funFirefox applet fun2008
XSS tag fuzzerXSS tag fuzzer2008 Double encoding javascriptDouble encoding javascript2008
Firefox find functionFirefox find function2008 Javascript cloning objectsJavascript cloning objects2008
Javascript getters hackingJavascript getters hacking2008 Codetcha updateCodetcha update2008
CodetchaCodetcha2008 Polymorphic javascriptPolymorphic javascript2008
Hidden javascript propertiesHidden javascript properties2008 Firefox javascript sandboxingFirefox javascript sandboxing2008
HackvertletsHackvertlets2008 Total Recall No JavascriptTotal Recall No Javascript2008
Hackvertor fixesHackvertor fixes2008 CSRF chatCSRF chat2008
Moz-binding XSS funMoz-binding XSS fun2008 Google payloadsGoogle payloads2008
Javascript regular expressionsJavascript regular expressions2008 Unicode half and full width conversionUnicode half and full width conversion2008
Code morphingCode morphing2008 DOM Da DOMDOM Da DOM2008
Hackvertor updateHackvertor update2008 Exploiting PHP SELFExploiting PHP SELF2008
Valid Javascript variablesValid Javascript variables2008 DOM for hackersDOM for hackers2008
DOM DOS FirefoxDOM DOS Firefox2008 Self replicating sourceSelf replicating source2008
I'm having a baby girlI'm having a baby girl2008 Javascript for hackers part 2Javascript for hackers part 22007
Hackvertor fuzzing toolHackvertor fuzzing tool2007 Tracking users across browsersTracking users across browsers2007
Hackvertor update & feature requestsHackvertor update & feature requests2007 Faking the unexpectedFaking the unexpected2007
Incrementing in CSSIncrementing in CSS2007 CSS animation!CSS animation!2007
CSS toggle buttonsCSS toggle buttons2007 CSS logicCSS logic2007
Browser window spawning DOSBrowser window spawning DOS2007 Latest security newsLatest security news2007
Ultimate XSS CSS injectionUltimate XSS CSS injection2007 Awesome XSSAwesome XSS2007
htmlentities is badly designedhtmlentities is badly designed2007 WebFu crouching tab hidden dosWebFu crouching tab hidden dos2007
Tag inspectorTag inspector2007 XCSSXCSS2007
Pointing the fingerPointing the finger2007 Unusual XSS vectorsUnusual XSS vectors2007
CSRF browser protectionCSRF browser protection2007 Firefox history DOS attackFirefox history DOS attack2007
Safari securitySafari security2007 Spoofing Firefox protected objectsSpoofing Firefox protected objects2007
WebFu - Using the Hackvertor hanzo swordWebFu - Using the Hackvertor hanzo sword2007 Hackvertor explainedHackvertor explained2007
WebFu Dojo - XSS self defenceWebFu Dojo - XSS self defence2007 Hackvertor video demoHackvertor video demo2007
Spambam beta testSpambam beta test2007 Verisign fix overlay vulnerabilityVerisign fix overlay vulnerability2007
IFrames security summaryIFrames security summary2007 JSCK demo updateJSCK demo update2007
JSCKJSCK2007 New version of Hackvertor releasedNew version of Hackvertor released2007
Regular expression challengeRegular expression challenge2007 BlogsecurityBlogsecurity2007
OpenID account securityOpenID account security2007 A bit of funA bit of fun2007
Google Adsense flaw revealedGoogle Adsense flaw revealed2007 Injecting the script tag into XMLInjecting the script tag into XML2007
Safari vulnerability look before you leapSafari vulnerability look before you leap2007 XSS attacks a practical exampleXSS attacks a practical example2007
iPhone Safari zero dayiPhone Safari zero day2007 OpenID security CSS overlaysOpenID security CSS overlays2007
Google Adsense CSRF holeGoogle Adsense CSRF hole2007 Combining Unicode and Hex decimalCombining Unicode and Hex decimal2007
HackvertorHackvertor2007 Flash XSSFlash XSS2007
Javascript for hackersJavascript for hackers2007 iframes are eviliframes are evil2007
Noscript has iframe protectionNoscript has iframe protection2007 New Spambam pluginNew Spambam plugin2007
Window name trickWindow name trick2007 How I found the Safari exploitHow I found the Safari exploit2007
Thank you and good night Planet PHPThank you and good night Planet PHP2007 So you think you're a hacker?So you think you're a hacker?2007
CSK demoCSK demo2007 CSK updateCSK update2007
Wordpress lockdownWordpress lockdown2007 The blogs you should readThe blogs you should read2007
Secure programming flowchartSecure programming flowchart2007 CSK CSS Scripting KitCSK CSS Scripting Kit2007
More browser bugs equals greater riskMore browser bugs equals greater risk2007 CSS LAN scannerCSS LAN scanner2007
CSS attacks!CSS attacks!2007 Protection against CSRFProtection against CSRF2007
Protection against CSRF part 2Protection against CSRF part 22007 Keeping safe onlineKeeping safe online2007
Safari beta zero daySafari beta zero day2007 Open source security toolsOpen source security tools2007
Random Javascript and PHP generationRandom Javascript and PHP generation2007 Firefox weird javascript executionFirefox weird javascript execution2007
Open source as a reward for the JS FuzzerOpen source as a reward for the JS Fuzzer2007 IE7 javascript echoIE7 javascript echo2007
More Javascript fuzzingMore Javascript fuzzing2007 XSS and FuzzingXSS and Fuzzing2007
Wordress security pluginWordress security plugin2007 Javascript port scannerJavascript port scanner2007
Online Javascript LAN scannerOnline Javascript LAN scanner2007 Reflected SQL injectionReflected SQL injection2007
PHP Mysql tipsPHP Mysql tips2007 Web development trends (estimation)Web development trends (estimation)2007
Vulnerability found in security toolVulnerability found in security tool2007 Increasing PHP performanceIncreasing PHP performance2007
Return of the Heyes CaptchaReturn of the Heyes Captcha2007 Tracking without cookiesTracking without cookies2007
Tracking without cookies part 2Tracking without cookies part 22007 Safari leaks Google queriesSafari leaks Google queries2007
Nearly 2 million emailsNearly 2 million emails2007 Javascript securityJavascript security2007
DNS explained (simplified)DNS explained (simplified)2007 OpenID security issuesOpenID security issues2007
Safari same origin holeSafari same origin hole2007 Heyes CaptchaHeyes Captcha2007
Better passwordsBetter passwords2007 Spambam hits 1000 downloadsSpambam hits 1000 downloads2007
Safari needs fixing!Safari needs fixing!2007 PasswordsPasswords2007
Authorisation techniquesAuthorisation techniques2007 Using TinyMCE and ScriptaculousUsing TinyMCE and Scriptaculous2007
Multiple versions of IEMultiple versions of IE2007 The mindset of a hackerThe mindset of a hacker2007
Forgotten passwordForgotten password2007 CodaCoda2007
Accessible captchasAccessible captchas2007 How to prevent phishingHow to prevent phishing2007
One-time Form tokensOne-time Form tokens2007 Protecting against form SpamProtecting against form Spam2007
SpamBam new versionSpamBam new version2007 CSS handy tipsCSS handy tips2007
What is OpenID and why hasn't it been setup correctly?What is OpenID and why hasn't it been setup correctly?2007 Adobe launches my feedzAdobe launches my feedz2007
Mysql performance tuningMysql performance tuning2007 Storing passwords securelyStoring passwords securely2007
SpamBam!SpamBam!2007 Secure free mailSecure free mail2007
Email form spam protectionEmail form spam protection2007 Why Microformats are badWhy Microformats are bad2007
PHP security extensionPHP security extension2007
JavaScript for hackers: Learn to think like a hacker, by Gareth Heyes
↑
•
↓