Breaking the silo
Cross-origin communication, trust boundaries, and the anatomy of postMessage XSS.
PZOD / SECURITY RESEARCH
A closer look at
how things break.
I’m an associate pentester and security consultant in Sydney. I write about the vulnerabilities I investigate, the tools I build, and what I learn along the way.
THE PERSON BEHIND THE WORK01 / PZOD
Pzod — security research and field notes
ASSOCIATE PENTESTER / SECURITY CONSULTANT Tap the letters
BASED INSydney, Australia
THE WORKPentesting & security consulting
THE COMMUNITYOffSec Ambassador
RESEARCH / PRACTICE / EXPLORATION
Web security · Active Directory · Offensive research
01 / SELECTED RESEARCHWhat I find.
What I find.
What it means.
Research, technical writeups, and the details behind the finding. These are a few places to start.
Explore all research
Advanced CrowdStrike Falcon evasion
A collection of notes on endpoint visibility and red team techniques.
Advanced SQL injection
Exploring injection patterns, filters, and modern application attack surfaces.
SSRF: from detection to RCE
Following a server-side request beyond the application's trust boundary.
02 / A SMALL EXPERIMENTSame prefix.
Same prefix.
Different origin.
A domain can look trusted and still belong to someone else. Change the comparison, send a message, and see exactly where the check fails.
Follow the full attack path01—03
Choose an origin. Change the check.
Watch what crosses the boundary.
INTERACTIVE STUDY001 / ORIGIN
UNTRUSTED ORIGINAPPLICATION CONTEXTTRUST BOUNDARY
origin-check.jsLOCAL DEMO
https://trusted.exampleCan a lookalike cross the boundary?
Try the lookalike with both checks.
Read the postMessage research Runs in your browser
03 / THE WORKBENCHBuilt to inspect.
Built to inspect.
Ready to explore.
Small utilities for inspecting tokens, following messages, and working through an idea.
Browse the toolsBROWSER / JWT
JWT Juggler
Inspect token structure and experiment with claims in a browser workspace.
Open workspaceBROWSER / postMessage
postMessage Auditor
Explore window messaging with a target frame and communication log.
Open workspace04 / NOTES & TALKSLearning.
Learning.
Then sharing.
From OSCP notes to technical presentations. The things that helped something click.
All field notesPZOD / SYDNEY, AUSomething worth
Something worth
looking into?
Research, collaboration, or a good technical conversation.
Let’s talk