JavaScript Libraries and Browser APIs Worth Knowing for Security (2025)
End-of-year post. This one is a roundup of JavaScript libraries and browser APIs that I’ve found interesting from a security angle in 2025 — either because they’re useful for offensive tooling, because they’re misunderstood in ways that create vulnerabilities, or because they expose attack surface that defenders miss. Not a “top 10” list with scores. Just ..
Read moreOffensive Callback (III): Inside the Browser Stealer — merch.js
Third post in the Offensive Callback series. This is the deep dive into the client-side JavaScript payload — what I call merch.js internally, served as dl.full.min.js by the XSS dealer. It’s the piece that runs in a victim’s browser and does all the actual collection work. The file is about 10,000 lines minified and bundles several libraries: a hashing lib..
Read more