A field guide to breaking the browser · alert(1337)

JavaScript
for hackersLearn to think like a hacker.

Ever wondered how a hacker finds flaws in the browser and JavaScript? This book shares the thought process and the tools to find your own, then builds payloads that shouldn't be possible, one character at a time.

Get the book → See what's inside
★★★★★ 4.5 / 5 from 42 ratings on Amazon · 105 pages · 8 chapters
// eight chapters, no fluff

Break JavaScript on purpose

The book assumes you already know JavaScript. What it teaches is the mindset: set a goal, fuzz relentlessly, and abuse every quirk the language will give you. Here's the ground it covers.

1.1M
Unicode code points fuzzed in seconds
0
Parentheses required to call a function
6
Characters: the great non-alpha wall
31
Language translations available
// what readers say

Loved by hackers & pentesters

Rated 4.5 out of 5 across 42 Amazon ratings, with 68% awarding five stars. A selection of verified reviews.

Gareth Heyes
Security researcher · PortSwigger
  • Best known for escaping JavaScript sandboxes and crafting super-elegant XSS vectors
  • Two-time Black Hat USA speaker, plus Black Hat Europe
  • Creator of Shazzer, the shared online browser fuzzer, fuzzing browsers since 2012
  • Author of PortSwigger's XSS Cheat Sheet and the Hackvertor, Taborator, DOM Invader and Shadow Repeater Burp tools
  • Co-author of Web Application Obfuscation
// about the author

The person who tweets the vectors you screenshot

"JavaScript has always been my passion. You can often see me posting ways to call functions without parentheses, insane XSS vectors, and deeper ways to understand a feature."

This book is that philosophy written down. In a fast, no-fluff 105 pages it hands you the exact techniques Gareth uses to break browsers, from calling functions without a single parenthesis to writing working code with just six characters. So the next time you hit a filter, a WAF, or a sanitizer everyone swears is airtight, you'll already know where it bends. Buy it once and it becomes the reference you keep open in the tab next to your payloads.

// exhibit A

Vectors elegant enough to frame

The book is full of payloads that look impossible until you understand them: an <img> that rewrites its own attributes, an <svg> that reassigns its onload mid-flight, and arbitrary code written with nothing but [ ] ( ) ! +.

Read them all →
Two signature XSS vectors from the book: an img attribute vector and an SVG onload vector, overlaid on the book's cover illustration.
// six ways to get it

Get JavaScript for hackers

Paperback, Kindle, ebook, and audiobook. Buy direct on Leanpub and pay what you want, or grab it from your store of choice.

JavaScript for hackers book cover: a purple illustrated head reclining with a laptop on a bright yellow background.
JavaScript for hackers105 pages · illustrated · 8 chapters

Leanpub is pay-what-you-want: $20 minimum, $35 suggested, and updates are free forever.