Collected research

Redefining Impossible: XSS without arbitrary JavaScript

Luan Herrera · PortSwigger Research · 23 September 2020

An injection restricted to letters, digits, quote, plus, dot and backticks can still call methods through tagged templates, building an oracle that reveals whether a character of document.cookie matches a guess. Execution time, and later window.stop plus location.assign observed through an iframe load event, leak the cookie character by character.

Record

Researcher

Luan Herrera

Published by

PortSwigger Research

Date

23 September 2020

Topic

XSS

In the archive

• Collected in the 2020 research round

Related sources

• Timing-based demonstration
• Load-based demonstration

Tags

• xsleak
• side-channel
• timing-attack
• xss
• info-leak
• filter-bypass
• iframe
• cookie
• javascript
• owasp-a03-2021
• owasp-a05-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Luan Herrera, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.