Posts

All the articles I've posted.

• DOMinator: a Chrome extension for hunting postMessage DOM XSS

  25 Sep, 2026

  DOMinator is now public on the Chrome Web Store. It records postMessage traffic, grades each listener's origin check, traces tainted values into sinks, and builds a replay and PoC from what it finds.

• $20000 Facebook DOM XSS

  8 May, 2020

  This is the story of how I found $20000 Facebook DOM XSS.