CIRCLE WITH A DOT

I just published a write-up on prototype pollution and how it leads to XSS.

The key idea: you’re not injecting into the sink—you’re controlling the property lookup that eventually reaches it.

Pollute → Gadget → Sink → Execution

Includes examples and common vulnerable patterns (merge functions, __proto__, etc.)

Just a moment...

(medium.com)

#Cybersecurity #WebSecurity #AppSec #Infosec #BugBounty

DOM XSS isn’t always in the HTML.

Sometimes your input never appears in the Source because JavaScript is building the page.
Source → Sink → Execution in real-world DOM flows.

Just a moment...

(medium.com)

#infosec #cybersecurity #bugbountytips #websecurity #OWASP