I haven't posted a crazy XSS vector for a while... Works on every browser

Both Hackvertor & Shazzer evolve the more you use them. It's such a shame they are not widely used and everyone is just using an LLM these days. That said I've found them both essential for conducting web security research.

Hackvertor evolves as you add tags. You're not just adding a new encoding, you're teaching the auto-decoder how to recognise and decode it too. Every custom tag makes Hackvertor smarter for future use. Read the tutorial to find out more... thespanner.co.uk/how-to-write...

You can now make a batch of private vectors public and assign them a collection in Shazzer. This is useful when presenting at a conference and you want to make a few public after the talk.

Messing around with inertia on my blog. Demo: thespanner.co.uk

I have a passion for 3D. I used to read 3D world magazine every month and the CD always contained trial software. I used to love messing around with 3D max and Poser. As I often do my interests pour into my research or projects. I made a 3D portfolio and a 3D tile blog. 1/2

I've added performance/feature vectors to Shazzer. Along with stats. You can now see which browsers perform better. It uses the same shared fuzzing network. shazzer.co.uk/stats/perfor...

On my lunch today I improve the Shazzer fuzz results toast. It looks really nice and can handle ranges easily.

Just finished an improved toast dialog in Shazzer. It now shows the char codes with a preview of the character too when you press "Test Fuzz" or "Fuzz". If the character isn't printable it shows hex instead. shazzer.co.uk

I think this is the best most elegant XSS vector I've ever found

Shazzer now displays ranges in nice unicode groups. I made the decision to convert large amount of character logs into ranges a while ago, this compresses the data really well and I can show massive amounts of data like JS variables easily.

Just realized that one of my favorite easter eggs I made while at Stripe is still on the /jobs page… The monitor in the photo mimics everything you do on the page itself. 🥚💅 (only visible on Firefox because it uses an experimental feature)

Shazzer can now fuzz over 1 million characters now. I got Claude to refactor the fuzzing code and now it fuzzes in chunks. This is amazingly fast on Chromium based browsers because sandboxed iframes are process isolated. Firefox is pretty slow because it does not do this.

I wanted to see what Claude was capable of and I have a keen interest in football statistics. So I started a new side project called False 9, it was meant to take a few days to get some interesting stats. It escalated. I started off manually syncing from the data provider.

I've just added the coolest feature to Burp Hackvertor. Smart paste. If you have multiple encodings on your clipboard, you can use CMD+SHIFT+V and Hackvertor will convert all the data and wrap it with encoding tags 😎

Your Shazzer profile page now evolves the more public vectors you have. It changes colour, increases connected circles and your level changes. shazzer.co.uk/profile?id=6...

Good post!

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer! The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below: jorianwoltjer.com/blog/p/stori... (and thanks @garethheyes.co.uk for making Shazzer!)

Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

That’s a first: GitHub’s Advisory Database (incorrectly) flags Puppeteer as malware. github.com/github/advis... We are no longer able to publish new releases. Are there any GitHub or Microsoft folks here who can help escalate this?

Allowed you to use Chrome's local AI model in Hackvertor tags. Warning it's very slow but should get better with time. You have to enable the local model in chrome://flags for it to work. hackvertor.co.uk/urls/33

Added AI features to Shazzer using Chrome's local model. They aren't very useful yet because the local model is very slow and isn't very smart but should improve over time when the model is updated. I've added: - AI write description - AI generate vector - AI generate variant

I broke Shazzer, should be fixed now

After extensive testing with more generic versions, I decided to make browser version numbers more accurate now in Shazzer. This will create more fuzz data but will be more useful to test quirks in browsers. I've also hid older browser versions by default and provide filtering.

Shazzer is now a social network. You can post messages, links and vectors. Let's build and break it together and create a true web security social network. shazzer.co.uk

I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations. hackvertor.co.uk/snippet

New Blog post: "Multiple things can be true at the same time" - frederikbraun.de/feels-and-ll... Dear reader, I am sure you have read a lot of blog posts about AI in the past weeks or months. This is my post.…

Cool exploit with @0x999.net: He found that \x7F breaks Chrome's "Copy as cURL (cmd)" command parsing in Windows Console Host. In combination with a ", it allowed you to add any arguments to curl. With -o writing files is easy, but we need the username for the startup path... (1/2)

String.fromCharCode overflows. I didn't know how this worked many years ago. Now it seems so simple. The maximum value a character can be generated is 0xffff. So if you want to generate A (0x41) you simply add one to the max value plus the character you want to generate. 1/2

If you haven't tried Shazzer yet you should give it a go. You can easily find browser behaviour and get it tested by other users or your team. It supports private vectors too and you can assign them to your team. You can even have your own private fuzzing network. 🔥🔥🔥

Just discovered the "Find tag" functionnality of Hackvertor and I already find it very useful 🔥 It can be triggered from Burp's command palette or with the Ctrl-Alt-F keyboard shortcut 🐇

Shazzer & Hackvertor OAuth was broken because of a Github change. Hopefully I've fixed the issues now.

Hehe WTF. shazzer.co.uk/vectors/69d0...

I improved the collection view in Shazzer. You can now expand the results below the vector. shazzer.co.uk/collections/...

Shazzer had an interesting bug. I write to a blob URL thats sandboxed but because its a blob URL it breaks relative URLs which means vectors with them would return false negatives. The fix was: use a base tag to change the domain. This fixes vectors like: shazzer.co.uk/vectors/69c8...

Been doing a lot of statistical analysis in my free time on yet another side project. It's quite fun and far less challenging than my other side projects.

New blog post: Perfect types with `setHTML()` - https://frederikbraun.de/perfect-types-with-sethtml.html - TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks....

You can now create collections of vectors on Shazzer. You can select up to 10 vectors and view the results of each by clicking a button. If anyone has any ideas to display the results in a better way let me know. shazzer.co.uk

Last night I added GZip and Deflate compression to Hackvertor. I also improved the autodecoder to detect it. Yesterday on my lunch I added autocompletion for HackPad and fixed a bunch of bugs. hackvertor.co.uk/urls/31

The Sanitizer API landed in Firefox 148, along with element.setHTML(). This lets you fully configure how HTML strings are cleaned as they're parsed. hacks.mozilla.org/2026/02/good...

Hackvertor v2.2.45 released! Fixed UI, primary buttons now have primary colour Websocket message editor (Big thanks snooze6) Hex edit functionality (Big thanks snooze6) Centred dialogs (Big thanks psalire)

Question is what do I build next? So exciting. So many ideas...

I've got to the point where I've implemented nearly every 1 of my ideas for Shazzer and Hackvertor. Claude played a big part in that. I'm proud of them both. My approach of semi-vibing was long winded but now I think it's really paid off in both knowledge and speed of development

I've added tool tips to the tags in Hackvertor!

Last night I made web Hackvertor more beautiful. I followed the same process I did with Shazzer. The footer is cleaned up and the nav bar now remembers the section and is reorganized.

just got xss with this 😎

I've added a modal dialog to confirm if you want to opt in to Shared fuzzing in Shazzer. If you've already made a choice it should not show. Sorry about the dialog they are annoying but necessary in this case.

New geolocation-based XSS vectors just landed in our XSS cheat sheet. Huge thanks to AmirMohammad Safari for the great submission. portswigger.net/web-security...