Topic · 1 article

dompurify

Advanced level

Mutation XSS — when the HTML changes between sanitizing and rendering

The sanitizer sees A but the browser renders B. SVG namespace tricks, badly-closed comments, MathML, the template element. How to find mXSS against DOMPurify and homemade sanitizers.

14 minmutation-xssxssdompurify

Read article

Practice dompurify with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See dompurify labs

All topics Academy

2,482

hunters training

labs from real hacks

1,630

completions

$14,790

paid out for these bugs

11 flags captured this week·Real hacks from HackerOne · YesWeHack · Bugcrowd·No commitment·Free Academy

Free · no account

The checklist I run on every new target

47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.

Unsubscribe in one click, from any email.

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime