Blog | Jorian Woltjer

Squid was a Server-Side Web challenge with just 3 solves in the end (not counting the several removed LLM-assisted solves 😄).

If you already follow the client-side world closely, there's a good chance you've heard of Shazzer, a tool by security researcher Gareth Heyes.

The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing.

A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab

A framework-level vulnerability in Astro found by AI.

How an AI agent found a cache deception vulnerability affecting default SvelteKit apps deployed on Vercel.

While attending 39C3, I had some time to play the yearly hxp CTF.

Every month, Intigriti hosts a hard Cross-Site Scripting challenge, made this month by @Renwa.

As is becoming a tradition (x3ctf - blogdog), I solved a hard, "leet" even, challenge by 🦊Rebane, overcomplicating it in very interesting ways.

Ways to turn XSS in a Web Worker into full XSS, covering known tricks and a new generic exploit using Blob URLs with the Drag and Drop API