CTF Walkthrough: Prototype Pollution from Client-Side to RCE (BLEACH Enterprise)
A few weeks ago, this CTF from XDMIRROR popped up on my feed: a mock corporate IT management panel called BLEACH Enterprise built entirely around prototype pollution. Five distinct gadgets, spanning from client-side DOM XSS and open redirects all the way to server-side auth bypass, SSRF, and full RCE in Node.js—all exploiting the exact same root cause vuln..
Read moreJavaScript Libraries and Browser APIs Worth Knowing for Security (2025)
End-of-year post. This one is a roundup of JavaScript libraries and browser APIs that I’ve found interesting from a security angle in 2025 — either because they’re useful for offensive tooling, because they’re misunderstood in ways that create vulnerabilities, or because they expose attack surface that defenders miss. Not a “top 10” list with scores. Just ..
Read moreClient-Side Hacking Curiosities (2025 edition)
Been accumulating a list of client-side weirdness all year. Things that surprised me, techniques I found while reading specs, and browser behaviours that look benign on paper but get interesting when you think adversarially. No particular order, no particular coherence — just a dump of things worth knowing if you spend time attacking or defending browser e..
Read moreOffensive Callback (III): Inside the Browser Stealer — merch.js
Third post in the Offensive Callback series. This is the deep dive into the client-side JavaScript payload — what I call merch.js internally, served as dl.full.min.js by the XSS dealer. It’s the piece that runs in a victim’s browser and does all the actual collection work. The file is about 10,000 lines minified and bundles several libraries: a hashing lib..
Read moreOffensive Callback (II): Dealers — Collection Points and Routing Engine
Second post in the Offensive Callback series. This one is about dealers: the server-side collection endpoints that define what happens when a request arrives and how telemetry gets delivered back. If you haven’t read the first post about the server architecture, start there. Here I’m going to focus entirely on the dealer system. What is a dealerA dealer i..
Read more
5ELG (I)/ Dealers wanna deal
In our previous post, we introduced 5ELG (https://github.com/jomoza/5ELG)This open-source project, with its modular “merca” (client-side) and “dealer” (server-side) components, offers a robust approach to tracking, data collection, and live monitoring, all within a customizable and scalable framework. Today, we’ll take a closer look at the full potential ..
Read moreBro5er dEaL finGerprinter, A Comprehensive Browser Fingerprinting Tool
Browser fingerprinting is a robust method for gathering detailed information about a user’s device, browser environment, and overall online behavior. With this data, websites and organizations can create a unique identifier for each user, even in scenarios where traditional tracking methods like cookies are ineffective. 5ELG - Bro5er dEaL finGerprinter is..
Read moreIntroduction to BeEF Automation with Discord Bots
BeEF: The Browser Exploitation FrameworkIntroductionBeEF (Browser Exploitation Framework) is a powerful tool used primarily by penetration testers and security researchers to assess the security posture of web browsers and the systems they interact with. By leveraging client-side attack vectors, BeEF allows for comprehensive testing and exploitation of br..
Read more
Weaponizing JavaScript II: Client-Side FUZZING
Client-Side Fuzzing: A JavaScript Approach for Web Vulnerability TestingClient-side fuzzing can be a fascinating approach to discovering web vulnerabilities by leveraging the browser’s capabilities to test for issues such as SQL Injection (SQLi) and Cross-Site Scripting (XSS). This post explores a JavaScript code snippet designed to perform fuzzing dire..
Read more
Weaponizing JavaScript: JSReceiver v0.0
🕵️ JSReciver v0.0 - Intercepting the Web, One Request at a Time! 🕵️ https://github.com/jomoza/rejsciver Let’s talk about this GitHub project called JSReciver. This JavaScript script is a real game-changer when it comes to intercepting HTTP requests and doing some sneaky stuff. You won’t believe what this script can do! 🎯 What can JSReciver intercept?JSR..
Read more