Jorian (@J0R1AN) / X

Jorian

292 posts

Jorian

@J0R1AN

Normalize being weird. (also here: bsky.app/profile/jorian…)

He/Him

Joined November 2019

Pinned
Jorian
@J0R1AN
Sep 14, 2023
I almost can't believe it, but I am finally releasing my Gitbook about CTF and Hacking, which is a year in the making. It contains many tricks, explanations, and resources from my experience and research. I hope it becomes a valuable resource for everyone! book.jorianwoltjer.com//
13K
Jorian
@J0R1AN
Apr 4, 2025
While listening to the @ctbbpodcast, I discovered that my own blog was vulnerable to Cache Deception! It would have allowed anyone to send me a link and then retrieve all hidden posts. This sent me down a caching deep dive, check out the details here:
Cache Deception on my new site! | Jorian Woltjer
From jorianwoltjer.com
12K
Jorian
@J0R1AN
Jun 13, 2025
Small tip for the JavaScript reverse engineers out there, Chrome has a `debug()` function which triggers a breakpoint whenever its first argument is called. It even works on built-in methods, no more wrapping stuff in proxies :D debug(DOMParser.prototype.parseFromString)
13K
Jorian
@J0R1AN
Jul 2, 2025
Here's my writeup the technique allowing some nonce-based CSPs to be bypassed. I think it definitely has some practical use, so included some details about different scenario's. Don't let that HTML-injection of yours wait!
Nonce CSP bypass using Disk Cache | Jorian Woltjer
From jorianwoltjer.com
13K
Jorian
@J0R1AN
Jan 26, 2025
During @x3ctf, I discovered an unintended solution that turned out to be a pretty cool generic technique. It allows you to detect the result of a selector during CSS Injection, bypassing any CSP restricting external requests! Check out the writeup below:
jorianwoltjer.com
x3CTF - blogdog (+ new CSS Injection XS-Leak!) | Jorian Woltjer
A "hard web xssbot" challenge about a fun browser quirk with the is= attribute to perform CSS Injection. Bypass the strict CSP with an unintended new technique to XS-Leak a selector's result by...
13K
Jorian
@J0R1AN
May 25, 2025
Double-Clickjacking, or "press buttons on other sites without preconditions". After seeing and experimenting with this technique for a while, I cooked up a variation that combines many small tricks and ends up being quite convincing. Here's a flexible PoC:
The Ultimate Double-Clickjacking PoC | Jorian Woltjer
From jorianwoltjer.com
21K
Jorian
@J0R1AN
Aug 1, 2025
#bugbountytips Template Injection payload list: {{7*7}} ${7*7}} 49 <%=7*7%>
11K
Jorian
@J0R1AN
Oct 4, 2024
During a recent CTF, one participant found a particularly interesting solution to my challenge. The goal was to send multiple CSRF requests with SameSite=Lax from 1 visit. Normally, a form sends you to the page you are posting to and you cannot send any more CSRF requests. (1/4)
19K
Jorian
@J0R1AN
May 17, 2025
The legendary @joaxcar made a really interesting XSS challenge this month for Intigriti. My solution involved winning a race condition with 100 <iframe>s to utilize a DOM Clobbering gadget after bypassing a RegEx. Check out the writeup below:
Intigriti May XSS Challenge (0525) | Jorian Woltjer
From jorianwoltjer.com
8.3K
Jorian
@J0R1AN
Jun 30, 2025
Just found an interesting way to bypass some nonce-based CSPs and made a small XSS challenge with an exploitable scenario. See if you can find it before I tell! Source JS: gist.github.com/JorianWoltjer/… URL: greeting-chall.jorianwoltjer.com Found a solution? Please DM to avoid spoilers, thanks!
17K
Jorian
@J0R1AN
May 9, 2025
While collecting some HTML-Injection techniques, I thought of an interesting way to abuse existing <form>s when XSS isn't an option. You can inject <input>s with form= pointing to the form's id= to add params, and make a <button> with form= and formaction= to change its action.
7.6K
Jorian
@J0R1AN
Jul 1, 2024
A few weeks ago, I wanted to learn more about XS-Leaks. This ended in a vulnerability in CTFd that was exploitable with a new technique to detect status codes! The following post goes through my process of finding it and the proof of concept exploits:
XS-Leaking flags with CSS: A CTFd 0day | Jorian Woltjer
From jorianwoltjer.com
8.8K
Jorian
@J0R1AN
Nov 27, 2024
To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all. If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this!
Mutation XSS: Explained, CVE and Challenge | Jorian Woltjer
From jorianwoltjer.com
6.4K
Jorian
@J0R1AN
Feb 23, 2025
Inspired by @PaulosYibelo, I thought about what improvements I could make to trick users into pressing buttons that perform sensitive actions. Finding some vulnerable targets along the way! Read the details in my latest blog post below:
Pressing Buttons with Popups (on Twitch, LinkedIn and more) | Jorian Woltjer
From jorianwoltjer.com
7.4K