Client-Side Hacking Curiosities (2025 edition)
Been accumulating a list of client-side weirdness all year. Things that surprised me, techniques I found while reading specs, and browser behaviours that look benign on paper but get interesting when you think adversarially. No particular order, no particular coherence — just a dump of things worth knowing if you spend time attacking or defending browser e..
Read moreOffensive Callback (IV): OSINT Pipeline and IP Intelligence
Fourth and last post in the Offensive Callback series. This one covers what happens server-side once the callback server has an IP address — the full intelligence enrichment pipeline that runs automatically for every new source IP that hits the system. The goal is to go from “an IP connected” to “here’s everything we know about that IP” with minimal manual..
Read moreOffensive Callback (III): Inside the Browser Stealer — merch.js
Third post in the Offensive Callback series. This is the deep dive into the client-side JavaScript payload — what I call merch.js internally, served as dl.full.min.js by the XSS dealer. It’s the piece that runs in a victim’s browser and does all the actual collection work. The file is about 10,000 lines minified and bundles several libraries: a hashing lib..
Read moreOffensive Callback (II): Dealers — Collection Points and Routing Engine
Second post in the Offensive Callback series. This one is about dealers: the server-side collection endpoints that define what happens when a request arrives and how telemetry gets delivered back. If you haven’t read the first post about the server architecture, start there. Here I’m going to focus entirely on the dealer system. What is a dealerA dealer i..
Read moreOffensive Callback: Multi-Protocol Passive Intelligence Collection
So I’ve been sitting on this for a while. I’ve been working on a tool that I call Offensive Callback — a passive intelligence collection server that captures inbound traffic across HTTP(S), WebSocket, DNS, and ICMP simultaneously, enriching every hit with browser telemetry, geolocation, and automated OSINT. This post is about the server itself: what it ru..
Read more
5ELG (I)/ Dealers wanna deal
In our previous post, we introduced 5ELG (https://github.com/jomoza/5ELG)This open-source project, with its modular “merca” (client-side) and “dealer” (server-side) components, offers a robust approach to tracking, data collection, and live monitoring, all within a customizable and scalable framework. Today, we’ll take a closer look at the full potential ..
Read moreBro5er dEaL finGerprinter, A Comprehensive Browser Fingerprinting Tool
Browser fingerprinting is a robust method for gathering detailed information about a user’s device, browser environment, and overall online behavior. With this data, websites and organizations can create a unique identifier for each user, even in scenarios where traditional tracking methods like cookies are ineffective. 5ELG - Bro5er dEaL finGerprinter is..
Read moreIntroduction to BeEF Automation with Discord Bots
BeEF: The Browser Exploitation FrameworkIntroductionBeEF (Browser Exploitation Framework) is a powerful tool used primarily by penetration testers and security researchers to assess the security posture of web browsers and the systems they interact with. By leveraging client-side attack vectors, BeEF allows for comprehensive testing and exploitation of br..
Read more
Weaponizing JavaScript II: Client-Side FUZZING
Client-Side Fuzzing: A JavaScript Approach for Web Vulnerability TestingClient-side fuzzing can be a fascinating approach to discovering web vulnerabilities by leveraging the browser’s capabilities to test for issues such as SQL Injection (SQLi) and Cross-Site Scripting (XSS). This post explores a JavaScript code snippet designed to perform fuzzing dire..
Read morePWN THIS CITY - I <3 MANA ATTACK
The MANA Attack: A Rogue Wi-Fi AdventureIntroductionIn the realm of Wi-Fi security, two intriguing attacks stand out: the MANA attack and the KARMA attack. Let’s delve into their mechanics and explore how the hostapd-mana tool enables these exploits. KARMA AttackThe KARMA attack exploits a behavior exhibited by some Wi-Fi devices, coupled with the absence ..
Read more