What you'll learn
Attacker skills you'll walk away able to run.
- Escalate a self-XSS from a low-impact alert into full account takeover
- Chain login CSRF to bind a victim session to an attacker identity
- Exploit OAuth "Dirty Dancing" redirect_uri and response_mode misconfigurations
- Abuse client-side path traversal with open redirects to force-load attacker script
- Smuggle polyglot PDF/WEBP uploads to bypass CSP and MIME sniffing
- Weaponize insecure postMessage receivers to reach DOM sinks and steal tokens
- Pivot through third-party and null-origin iframes onto IdP/RP surfaces
- Drive login and OAuth flows from credentialless iframes against the primary origin
- Smuggle subdomain cookies to override relying-party expectations
- Bomb oversized cookie jars to clobber legitimate authentication state
- Map singular low-severity findings onto a critical account-takeover chain
- Analyze inline, obfuscated, minified, and lazy-loaded JavaScript for gadgets
The Course
Turn singular lows into critical takeover chains.
This expansion focuses on the modern application landscape, where combinations of subdomain XSS, misconfigurations, and overlooked JavaScript gadgets can open the door to high-impact exploitation. Unlike surface-level XSS training, we focus on showing you how chaining singular, low-impact vulns leads to higher-impact account takeover chains.
You'll master
// escalation
- OAuth Dirty Dancing
- Login CSRF
- Self-XSS to ATO
- Client-side path traversal
- postMessage bugs
- Iframe attack surfaces
- Subdomain XSS
- Cookie smuggling & bombing
Who it's for
// audience
- Penetration testers
- Red teamers
- Bug bounty hunters ready to push past basic payloads
- Anyone chasing real escalation paths, not just alert boxes
What's included
// package
- Live training and Q&A
- Class recordings available online
- Certificate of completion
- 8 hours of content
- Community access
- Bulk purchases available
Syllabus
Thirteen modules, one escalation map.
Every module is exploit-driven and lab-backed. The chain builds from vocabulary and threat surface all the way to full account takeover, plus a bonus JavaScript analysis module pulled from TBHM Core.
M01Intro: Framing the chaining mindset
- Chain vocabulary: self-XSS → login CSRF → OAuth misconfig → subdomain cookie abuse → ATO
- Threat surface: identities, tokens, cookies, storage, iframes, upload/CDN edges
- Mental model: "data that moves → trusts that break"
M02OAuth Dirty Dancing
- Parameters that matter (fast pass): client_id, redirect_uri strictness, response_type, response_mode, scope, state, nonce, code_verifier/PKCE
- The Franz Rosen gadget: structure, preconditions, and where it hides (RP vs. IdP vs. proxy)
- Exploit code patterns: crafting malicious redirect_uri/response_mode combos
- State handling pitfalls (generation, storage, reflection)
- Token bounce/relay tricks; mixing origins with permissive allowlists
- Hardening notes to call out (one-liners, not a lecture)
M03Login CSRF
- Preconditions: auto-login endpoints, weak state, token reuse, GET/POST quirks
- Exploit code patterns: GET/POST login CSRF payloads that bind victim to attacker account
- SameSite edge cases; silent auth endpoints
- Outcome: stable victim session bound to attacker identity
M04Self-XSS → ATO (Part 1)
- Typical footholds: profile fields, comment boxes, postMessage receivers
- Exploit code patterns: from clipboard/console "self-XSS" to stored DOM sink
- Piggyback the login CSRF to flip session/identity mid-flow
- Outcome: self-XSS becomes real XSS with the victim's privileges
M05Client-side path traversal + open redirect
- Pitfalls: naïve new URL(), joiners, .. normalization, custom routers
- Exploit code patterns: traversal to internal loaders; force-load attacker script via open redirect
- Build canonical XSS chain: traversal → open redirect → script sink
- Outcome: reliable DOM XSS on strict frontends
M06Client-side path traversal + file upload
- Key idea: PDF/WEBP that is also valid JSON/JS (polyglot conventions)
- Exploit code patterns: JSON-valid PDF/WEBP to smuggle attacker-controlled config
- JS-valid PDF/WEBP served with lenient sniffing → CSP bypass route
- Storage/hosting gotchas that make this land (CDN, MIME, sniffers)
M07postMessage bugs
- Anti-patterns: no origin check, loose schema, eval/Function
- Exploit code patterns: shaping messages to hit sinks; stealing tokens/CSRF via responses
- Upgrading via Dirty Dancing: message → OAuth hop → account control
M08XSS in a third-party iframe (Open-faced iframe sandwich)
- Model: parent ↔ 3P iframe ↔ IdP/RP surfaces
- Exploit code patterns: using the iframe XSS as a staging area for OAuth Dirty Dancing
- Bypassing UI isolation with permissive postMessage bridges
- Outcome: ATO via 3P content that "isn't ours"
M09The power of null-origin iframes
- What "null" actually strips, and what it doesn't
- Exploit code patterns: driving OAuth/login CSRF flows from null-origin sandboxes
- Moving data between contexts to retain the win
M10Credentialless iframes
- Where credentialless helps attackers (and where it kills them)
- Exploit code patterns: self-XSS → credentialless bridge → CSRF/XSS on primary
- Cookie scoping surprises when requests lose credentials
M11Subdomain XSS, Part 1: Cookie smuggling
- Domain vs. host vs. path semantics in the real world
- Exploit code patterns: smuggling cookies that override RP expectations
- Targeted path cookies → data exfil + CSRF in "secure" areas
- Chain: subdomain XSS → smuggle → skip login CSRF → ATO
M12Subdomain XSS, Part 2: Cookie bombing
- Exploit code patterns: forcing oversized cookie jars to clobber legitimate state
- Dirty-dance variant: bomb → fall back path → unintended OAuth
- Side effect: app-level DoS and auth instability
M13Conclusion
- Visual chain map of all paths to ATO
- Quick mitigations checklist (one slide)
- Disclosure hygiene: what to report, how to keep chains reproducible
BONUSJavaScript Module from TBHM Core
- Cheatsheets (BETA)
- Raw Analysis
- Inline JS
- Obfuscated JS
- Lazy Loaded JS
- Minified JS
- Mobile JS Analysis
- Advanced tooling and tips for all the above
Bench & Prep
Tooling you'll see, and pre-reads to bring.
Minimal call-outs only. The labs stay focused on the chain, not the setup.
Tooling in code
// hands-on
- Browser: JS payloads, window.postMessage, URL games, CSP pokes
- Interception: Burp/Caido for shaping OAuth params and redirects
- Crafting: curl one-liners, tiny HTML/JS launchers, polyglot builders
Pre-reads
// come ready
- OAuth state/nonce best practices; PKCE quick refresher
- postMessage secure patterns; cookie scope/domain primer
- Short note on polyglot file structure (PDF/WEBP/JSON/JS)
Course facts
// logistics
- Recommended level: Intermediate–Advanced
- 8 hours of content, on demand
- Live training and Q&A, recordings online
- Community access included
What your employer gets
- Testers who escalate medium findings into demonstrable critical account takeovers
- Deep client-side attack expertise across OAuth, login CSRF, postMessage, iframes, and cookies
- Engineers who chain singular, low-severity bugs into real, reproducible impact
- Reviewers who understand CSP, CORS, and cookie-scoping failures in modern applications
- Reporting discipline: reproducible chains and clear mitigation checklists
Your Instructors
Taught by Jonathan Dunn & Jason Haddix.
JD
Jonathan Dunn
XSSDoctor · Lead Author & Instructor
A veteran bug bounty hunter and client-side exploitation specialist known across the community as XSSDoctor. Jonathan authored this expansion and teaches the XSS, bug-chaining, and escalation tradecraft that turns mediums into criticals.
JH
Jason Haddix
Founder · Creator of The Bug Hunter's Methodology
Creator of The Bug Hunter's Methodology and founder of Arcanum, ranked 85th all-time on Bugcrowd. Jason co-teaches and ties the advanced client-side work back into the broader hunting methodology.
Details
Refund & access policy.
Are registrations refundable?
Because our training includes proprietary, cutting-edge content, all registrations are non-refundable.
What if I can't attend live?
If you are unable to attend live sessions, full recordings will be provided following the conclusion of the course so you can access the material on your own schedule.
What level should I be at?
This course is recommended for Intermediate to Advanced practitioners. It is hands-on and escalation-driven, built for testers who want to push past basic payloads into real chaining.
Can I buy seats for my team?
Yes. Bulk purchases and team discounts are available. Reach out and we'll set up seats and bulk pricing for your team.
From self-XSS to full ATO.
Learn the escalation paths that turn mediums into criticals. Enroll now, learn on your own schedule.
