@garethheyes.co.uk - Gareth Heyes

16 Sep 2026 20:50 +0000

I've added a super powerful feature to Hackvertor. Check tags.They let you perform expressions on tags <@check(isJson)>{"a":1} && <@encode(base64)>{"a":1} The above example only returns base 64 encoded JSON if the first is valid JSON. https://thespanner.co.uk/hackvertor-check-tags-and-conditions

16 Sep 2026 12:04 +0000

Did a small post about mutating Safari a behaviour that Shazzer found. https://thespanner.co.uk/mutating-safari

12 Sep 2026 13:13 +0000

Burp Hackvertor now has jigsaw mode too!

11 Sep 2026 21:29 +0000

Just something I've been working on. Jigsaw mode in Hackvertor!

02 Sep 2026 11:16 +0000

I've added a single execution type in Shazzer. This allows you to execute JS once. Useful for enumerating things in a browser such as events. Example vector: https://shazzer.co.uk/vectors/665a2e0046ae9018753b3ff4

30 Aug 2026 19:54 +0000

Safari actually supports CSS random! It's buggy but it does work. My escape room puzzles are now randomised on desktop and iPhone other browsers will follow

30 Aug 2026 10:47 +0000

The coolest part of Shazzer is the fuzzing network. To reflect that I've updated the design and added animations. Now you can see swarms of browsers when they are connected shazzer.co.uk/network https://shazzer.co.uk/network

28 Aug 2026 19:53 +0000

Added a trophy room to my 3D world with what I think is my best work. Claude casually building 3D CSS like it's nothing...

28 Aug 2026 16:30 +0000

I've made a major change to Shazzer. It will now collate historical fuzz result data. Previously to save costs it would remove older result data. I've since upgraded my db server. We should then have a history of interesting browser data. You can get RSS feeds of fuzz results too

27 Aug 2026 20:21 +0000

Made the gallery a zig zag shape instead which fixes the performance glitches on Chrome. Check it out! garethheyes.co.uk https://garethheyes.co.uk/

26 Aug 2026 20:20 +0000

Fixed another collision bug. If you opened the doors you could walk through walls.

26 Aug 2026 19:53 +0000

Yes do it 🥳 [contains quote post or other embedded content]

26 Aug 2026 19:47 +0000

Fixed collision detection bugs on my website

26 Aug 2026 11:52 +0000

My site now uses random() to randomize the solutions to the escape room. Random isn't available yet in any modern browser so it will fallback to a static solution.

25 Aug 2026 20:59 +0000

Hehe my escape room even works on my iPhone 😂

25 Aug 2026 19:40 +0000

With Claude I've created CSS/HTML only escape room puzzles on my website. Check it out! Absolutely no JS! Claude created the puzzles so it was quite fun trying to solve them myself 😀 garethheyes.co.uk https://garethheyes.co.uk/

25 Aug 2026 18:28 +0000

I 😻 Firefox

25 Aug 2026 14:25 +0000

I put a JavaScript URL inside an HTML tag name, and every browser executed it. Apparently, tag names are code now. http://portswigger.net/research/whats-in-a-tag-name-javascript-apparently

13 Aug 2026 20:59 +0000

You can now generate QR codes in web Hackvertor to share your URLs in presentations. Just click the QR code button.

13 Aug 2026 14:33 +0000

I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: https://portswigger.net/research/css-the-bomb-inside-your-inbox

12 Aug 2026 13:19 +0000

@html5test.com I saw you're doom game :) you could probably do it in pure HTML/CSS. Check this out collision detection in CSS: https://thespanner.co.uk/pure-css-3d-world-collision-detection

06 Aug 2026 23:45 +0000

If you want to see how to compromise an account from a paste and steal passwords in CSS and much more check out my paper "CSS: the bomb inside your inbox" 👇 https://portswigger.net/research/css-the-bomb-inside-your-inbox

29 Jul 2026 13:51 +0000

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

25 Jul 2026 12:49 +0000

I've wrote up how to do collision detection in pure CSS. I had loads of fun doing this. https://thespanner.co.uk/pure-css-3d-world-collision-detection

25 Jul 2026 11:31 +0000

Fixed the teleports on my site. The burger menu now works on all browsers. I'd previously tried to get this working and failed. Opus just did it in about 5 mins. garethheyes.co.uk https://garethheyes.co.uk/

24 Jul 2026 19:00 +0000

My 3D world now has collision detection in CSS! If you run into a wall or door it will stop. Open the door and you can go through. This model is unbelievable. garethheyes.co.uk