Intigriti

Exploiting prototype pollution in a vulnerable jQuery plugin to manipulate the HTML sanitizer's whitelist and achieve XSS. By injecting custom attributes into the global object, the attack bypasses client-side filtering and executes a malicious payload.

Bypassing DOMPurify's sanitization using namespace confusion in MathML to achieve XSS on the challenge web application. This involved analyzing obfuscated JavaScript, reversing URL parameter handling, and leveraging a known DOMPurify bypass to successfully trigger the exploit.