Gareth Heyes

@garethheyes

javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>

javascript:
garethheyes.co.uk
Joined October 2008
49 Photos and videos Photos and videos

Tweets

You blocked @garethheyes

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @garethheyes

  1. Pinned Tweet
    18 Aug 2021

    Pure CSS first person 3D website portfolio without any JavaScript whatsoever heavily inspired by

    12 replies . 22 retweets 139 likes
    Show this thread
    Show this thread
    Undo
  2. Retweeted
    Apr 13

    Ever encountered a client/server using an additional HTTP transport encoding or encryption? We've got you covered in our newest extension blog post with interesting Burp internals

    17 retweets 22 likes
    Undo
  3. Retweeted
    Apr 10

    TIL: <script type="importmap">{"imports": {"xss": "data:text/javascript,export default alert(1)"}}</script> <script type=module>import "xss"</script>

    92 retweets 459 likes
    Undo
  4. Retweeted
    Apr 9

    Here are the slides for my talk about the Sanitizer API, its security guarantees and how to verify them. Looking forward to your feedback! .

    2 replies . 39 retweets 105 likes
    Undo
  5. Retweeted
    Apr 6

    Looking forward to this week. I’m going to talk about the security considerations that went into the Sanitizer API for the web (prototype already exists in Firefox and Chrome) and the pitfalls we encounter(ed) when developing it.

    1 reply . 5 retweets 28 likes
    Show this thread
    Show this thread
    Undo
  6. Retweeted
    Apr 5

    We've updated our XSS cheat sheet to remove obsolete browsers and updated the vectors to reflect new browser behaviour. Check it out!

    1 reply . 77 retweets 279 likes
    Undo
  7. Apr 1

    I had a preview of this talk and it's outstanding as always. We are very lucky to have a researcher like James that can do fantastic research but also present in an accessible way.

    "Hunting evasive vulnerabilities: finding flaws that others miss" - from - will be premiering at Berlin in just a few days. If you can't catch the live event, it'll be available on YouTube post-conference.
    12 likes
    Undo
  8. Apr 1

    Ange is an outstanding researcher. If you need someone with great knowledge about file formats look no further.

    It's a great date to have your request to work remotely rejected because it's "not aligned with your team or organisation" even if the whole team and hierarchy is working in different locations or countries. I'm looking for a WFH position, starting June: file formats, RE, fuzzing
    Show this thread
    4 likes
    Undo
  9. Retweeted
    Mar 26

    highlighted-code is a textarea builtin extend that's embarrassing how simple, a11y compliant, versatile and lightweight is, compared to most competitors ... it's literally a textarea that shows highlighted code, usable in forms too 👍

    10 replies . 10 retweets 100 likes
    Show this thread
    Show this thread
    Undo
  10. Retweeted
    Mar 24
    Replying to and

    And thank for the third time's in this month for his great Dom based help to community especially the great Dom invader tool which help me to find all these bugs :D

    1 reply . 1 retweet 4 likes
    Undo
  11. Retweeted
    Mar 23

    I promise I’ll release a writeup of this bug soon with more background how I stumbled upon it but for now here we go (I think it’s the most crazy parser bug I’ve ever found)

    Security: invalid parsing of HTML by tree_builder_simulator leading to mutation XSS (reward: $5000)
    4 replies . 17 retweets 171 likes
    Undo
  12. Mar 23

    Wonder if the archive attribute still works 🤔

    So you could package up JavaScript into a JAR archive and distribute it client side complete with signing. 25 years ago.
    Show this thread
    2 replies . 2 retweets 13 likes
    Undo
  13. Retweeted
    Mar 19

    My colleague recently reminded me that Python executes zip files which of course extends to other zip-based formats and lets you do things like this.

    A terminal screenshot with the following code: $ echo 'print("HELLO WORD!")' > __main__.py $ zip my-document.docx __main__.py $ (echo '#!/usr/bin/env python3'; cat my-document.docx) > legit.docx $ ./legit.docx HELLO WORD! $ # legit.docx still opens in Word but with a warning
    8 replies . 123 retweets 650 likes
    Show this thread
    Show this thread
    Undo
  14. Retweeted
    Mar 16

    10M downloads per month😅🙈

    5 replies . 9 retweets 201 likes
    Undo
  15. Mar 13

    Nobody seems to remember E4X and nobody used it. I loved it

    1 reply . 4 retweets 19 likes
    Undo
  16. Retweeted
    Mar 12

    CSS Modules in Chrome and Edge 93 🎉

    3 replies . 10 retweets 66 likes
    Undo
  17. Retweeted
    Mar 11

    Introducing in-app recon to the Web Security Academy, with the brand new mystery lab challenge! This new feature gives academy users the chance to find and exploit vulnerabilities by generating a random lab to test their skills.

    2 replies . 47 retweets 179 likes
    Undo
  18. Retweeted
    Mar 10

    🔥Keynote Talk title is out! 💡James will pick out evasive found across a decade of research by exploring factors of how those bugs & attack classes evaded detection 😎Get your ticket➡️

    and
    25 retweets 110 likes
    Undo
  19. Retweeted
    Mar 9

    A proposal for type syntax in JavaScript ^ar

    11 retweets 37 likes
    Undo
  20. Retweeted
    Mar 7

    New Writeup - Circumventing Browser Security Mechanisms For SSRF. In this blog post we find our way around browser's mixed content policy to perform a SSRF against headless Chrome. Ft.

    3 replies . 136 retweets 387 likes
    Undo
  21. Mar 4

    Proud to work at PortSwigger!

    PortSwigger has today donated $225,000 to the International Red Cross to support their work helping the victims of the attack on Ukraine. Half of this money came from the bug bounty fund, and this amount was matched by the business.
    3 replies . 1 retweet 56 likes
    Undo

@garethheyes hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·