Controls

Mac

Ctrl+Alt+W
Up
Ctrl+Alt+A
Left (face west)
Ctrl+Alt+D
Right (face east)
Ctrl+Alt+S
Down
Ctrl+Alt+X
Stop

Windows

Shift+Alt+W
Up
Shift+Alt+A
Left (face west)
Shift+Alt+D
Right (face east)
Shift+Alt+S
Down
Shift+Alt+X
Stop

Movement speed

Gareth Heyes

PortSwigger researcher Gareth Heyes is probably best known for his work escaping JavaScript sandboxes, and creating super-elegant XSS vectors. When he's not authoring books (like the recent title, JavaScript for hackers), Gareth is a father to two wonderful girls and husband to an amazing wife, as well as an ardent fan of Liverpool FC.

In his daily life at PortSwigger, Gareth can often be found creating new XSS vectors, researching new techniques to attack web applications, and preparing to speak at conferences around the globe. He's also the author of PortSwigger's XSS Cheat Sheet, and the creator of Hackvertor and Taborator.

Inspiration

Profile
LinkedIn Twitter Mastodon Bluesky Blog Email
Contact
DOM Invader Hackvertor website Hackvertor BApp Shazzer website Taborator BApp SSPP Scanner
Tools
XSS for PDFs DOM sandbox escapes JSON hijacking Unknown browsers XSS horror show Non-alpha JS/PHP Splitting the email atom
Talks
Inspiration
JS for hackers · paperback JS for hackers · ebook Web App Obfuscation
Books
JavaScript for hackers Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevTools
AutoVader Shadow Repeater v1.2.3 release
Inline Style Exfiltration: leaking data with chained CSS conditionals Hacking rooms
valueOf: Another way to get this The curious case of the evt parameter
CSS-Only Tic Tac Toe Challenge Shadow Repeater:AI-enhanced manual testing
Concealing payloads in URL credentials onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet
Hiding payloads in Java source code strings Exploiting XSS in hidden inputs and meta tags
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO Server-side prototype pollution: Black-box detection without the DoS
Stealing passwords from infosec Mastodon - without bypassing CSP Safari is hot-linking images to semi-random websites
The seventh way to call a JavaScript function without parentheses Framing without iframes
Widespread prototype pollution gadgets New XSS vectors
Creating a 3D world in pure CSS Finding DOM Polyglot XSS in PayPal the Easy Way
Evading defences using VueJS script gadgets When alert fails: exploiting transient events
Escaping JavaScript sandboxes with parsing issues JavaScript without parentheses using DOMMatrix
SVG animate XSS vector Bypassing AngularJS bind HTML
XS-Leak: Leaking IDs using focus Bypassing CSP with policy injection
Abusing jQuery for CSS powered timing attacks Exposing Intranets with reliable Browser-based Port scanning
Rewriting relative urls with the base tag in Safari Evading CSP with DOM-based dangling markup
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing DOM based AngularJS sandbox escapes
Bypassing CSP using polyglot JPEGs Executing non-alphanumeric JavaScript without parenthesis
Edge XSS filter bypass Burp Clickbandit: A JavaScript based clickjacking PoC generator
Abusing Chrome's XSS auditor to steal tokens New IE mutation vector
MentalJS DOM bypass XSS Auditor bypass
Unbreakable filter mXSS
Bypassing the XSS filter using function reassignment Sandboxed jQuery
Epic fail IE Decoding complex non-alphanumeric JavaScript
DOM Clobbering The evolution of code
Tweetable PHP-Non Alpha Opera x domain with video tutorial
MentalJS Sandbox/Parser Hacking caja part 2
PHP nonalpha tutorial Code mutation experiments
Unicode rendering errors Eval a url
RIPS static source code analyser Introducing Shazzer: A shared online fuzzer
HTML scriptless attacks staticHTML property
We need @ urls Protecting against XSS
Unicode monster is back this time eating chrome The JSON specification is now wrong
JSON Hijacking DOM sandboxing talk
Regex HTML Sanitisation can work How do you spell JavaScript again?
XSS Rays extension Late meta Christmas present
JSReg bypasses New Hackvertor upgrade
XSS Zones Function is the new window
Setters using VBS and constant hacks Astalanumerator 0.7
Hackvertor Ajax applications Month of PHP security
HTMLReg Solving the secret question problem
Hackvertor API My RegExp is still leaking
Facebook sandbox escape Ping pong obfuscation
Bypassing CSP for fun, no profit PHP self return of the slash
Fresh prototypes on all browsers JSReg update
New beta of JSReg Minor Safari cross domain bug
New PHPIDS vector Hackvertor obfuscated code tutorial
Opera XSS vectors onreadystatechange
XSS Rays Hackvertor now translates
Javascript unique strings with RegExps Detecting IE in 12 bytes
Hackvertor now decodes css escapes Crazy javascript
I know what your friends did last summer Location based XSS attacks
Javascript vbscript challenge Wordpress plugin security
To infinity and beyond! XSS is art
New XSS vector Strings to array
Javascript protocol fuzz results XSS tag fuzzer
Double encoding javascript Javascript getters hacking
Codetcha update Hidden javascript properties
Firefox javascript sandboxing Hackvertor fixes
CSRF chat Javascript regular expressions
Unicode half and full width conversion Hackvertor update
Exploiting PHP SELF DOM DOS Firefox
Self replicating source Hackvertor fuzzing tool
Tracking users across browsers Incrementing in CSS
CSS animation! Browser window spawning DOS
Latest security news htmlentities is badly designed
WebFu crouching tab hidden dos Pointing the finger
Unusual XSS vectors Safari security
Spoofing Firefox protected objects WebFu Dojo - XSS self defence
Hackvertor video demo IFrames security summary
JSCK demo update Regular expression challenge
Blogsecurity Google Adsense flaw revealed
Injecting the script tag into XML iPhone Safari zero day
OpenID security CSS overlays Hackvertor
Flash XSS Noscript has iframe protection
New Spambam plugin Thank you and good night Planet PHP
So you think you're a hacker? Wordpress lockdown
The blogs you should read More browser bugs equals greater risk
CSS LAN scanner Protection against CSRF part 2
Keeping safe online Random Javascript and PHP generation
Firefox weird javascript execution More Javascript fuzzing
XSS and Fuzzing Online Javascript LAN scanner
Reflected SQL injection Vulnerability found in security tool
Increasing PHP performance Tracking without cookies part 2
Safari leaks Google queries DNS explained (simplified)
OpenID security issues Better passwords
Spambam hits 1000 downloads Authorisation techniques
Using TinyMCE and Scriptaculous Forgotten password
Coda One-time Form tokens
Protecting against form Spam What is OpenID and why hasn't it been setup correctly?
Adobe launches my feedz SpamBam!
Secure free mail PHP security extension
How to write a Hackvertor tag Speedy RSVP extension
Hackvertor history and tag finder Burp Hackvertor v2.1.24 release
Repeater Strike: manual testing, amplified XSSing TypeErrors in Safari
Making the Unexploitable Exploitable with X-Mixed-Replace on Firefox Document My Pentest: you hack, the AI writes it up!
SAML roulette: the hacker always wins Bypassing character blocklists with unicode overflows
Splitting the email atom: exploiting parsers to bypass access controls Using form hijacking to bypass CSP
Blind CSS Exfiltration: exfiltrate unknown web pages Bypassing CSP via DOM clobbering
Exploiting prototype pollution in Node without the filesystem Hijacking service workers via DOM Clobbering
Detecting web message misconfigurations for cross-domain credential theft Our favourite community contributions to the XSS cheat sheet
Using Hackability to uncover a Chrome infoleak Bypassing Firefox's HTML Sanitizer API
Bypassing CSP with dangling iframes uBlock, I exfiltrate: exploiting ad blockers with CSS
Hunting nonce-based CSP bypasses with dynamic analysis Portable Data exFiltration: XSS for PDFs
Bypassing DOMPurify again with mutation XSS Attacking and defending JavaScript sandboxes
Documenting the impossible: Unexploitable XSS labs DOM Clobbering strikes back
XS-Leak: Detecting IDs using Portal AngularJS CSP bypass in 56 characters
One XSS cheatsheet to rule them all Provoking browser quirks with behavioural fuzzing
XSS without parentheses and semi-colons Bypassing WAFs and cracking XOR with Hackvertor
Bypassing DOMPurify with mXSS Hackability inspector
Abusing JavaScript frameworks to bypass XSS mitigations RCE in JXBrowser JavaScript/Java bridge
JSON hijacking for the modern web Adapting AngularJS payloads to exploit real world applications
XSS without HTML: Client-Side Template Injection with AngularJS XSS in hidden input fields
Noscript XSS filter bypass How I smashed MentalJS
Another XSS auditor bypass Bypassing the IE XSS filter
MentalJS bypasses Java Serialization
RPO X-Domain scroll detection on IE using focus
new operator Hacking Firefox
Bypassing XSS Auditor Non-Alpha PHP in 6-7 charset
MentalJS for PHP Sandboxing and parsing jQuery in 100ms
Firefox knows what your friends did last summer Caja hacking
Multi-context XSS injection contest Pngfix
JSLR XSS technique without parentheses
Data enumeration tutorial in Shazzer Breaking feeds
NULLs in entities in Firefox Non-alpha JavaScript and PHP slides
Non alphanumeric code in PHP PHP CSSReg
Decoding non-alphanumeric code with Hackvertor JSReg down but not out
Opera parser monster eats unicode Blog fight round two
Hackvertor supports 0Auth Hackvertor export API
Jump off a bridge specification Breaking HTML parsers for fun
Preventing social network worms String replace JavaScript bad design
One vector to rule them all setTimeout and setInterval
Sandboxed DOM API Can all mozilla people look away now please
Regular expression sandboxing DOM CSS fight at the O.K. Corral
Astalanumerator update Writing Hackvertor tags
Hackvertor and JSReg The safety net
HTML5 new XSS vectors Twitter misidentifying context
My RegExp is leaking Javascript compression with unicode characters
Creating HTML listeners with JSReg and Hackvertor Hidden Firefox properties revisited
CSP - Mozilla content security policy Asta la vista baby
Astalanumerator baby Three-Strikes and you're DOSd
Overwriting native functions in javascript Cross browser javascript sandbox
HTML5 XSS Inline UTF-7 E4X javascript hijacking
Detecting browsers javascript hacks JSReg javascript parser
Sliceya CAPTCHA Calling the Array constructor in IE
PHPIDS bypass IP conversion
Hackvertor and clickjacking Bluehat
Javascript protocol fuzzer and Opera E4X for hackers
CSS overlays and frame breakers Hackvertor discussion
Javascript protocol fuzzer Firefox applet fun
Firefox find function Javascript cloning objects
Codetcha Polymorphic javascript
Hackvertlets Total Recall No Javascript
Moz-binding XSS fun Google payloads
Code morphing DOM Da DOM
Valid Javascript variables DOM for hackers
I'm having a baby girl Javascript for hackers part 2
Hackvertor update & feature requests Faking the unexpected
CSS toggle buttons CSS logic
Ultimate XSS CSS injection Awesome XSS
Tag inspector XCSS
CSRF browser protection Firefox history DOS attack
WebFu - Using the Hackvertor hanzo sword Hackvertor explained
Spambam beta test Verisign fix overlay vulnerability
JSCK New version of Hackvertor released
OpenID account security A bit of fun
Safari vulnerability look before you leap XSS attacks a practical example
Google Adsense CSRF hole Combining Unicode and Hex decimal
Javascript for hackers iframes are evil
Window name trick How I found the Safari exploit
CSK demo CSK update
Secure programming flowchart CSK CSS Scripting Kit
CSS attacks! Protection against CSRF
Safari beta zero day Open source security tools
Open source as a reward for the JS Fuzzer IE7 javascript echo
Wordress security plugin Javascript port scanner
PHP Mysql tips Web development trends (estimation)
Return of the Heyes Captcha Tracking without cookies
Nearly 2 million emails Javascript security
Safari same origin hole Heyes Captcha
Safari needs fixing! Passwords
Multiple versions of IE The mindset of a hacker
Accessible captchas How to prevent phishing
SpamBam new version CSS handy tips
Mysql performance tuning Storing passwords securely
Email form spam protection Why Microformats are bad
JavaScript for hackers: Learn to think like a hacker, by Gareth Heyes
↑
•
↓