Browser Security PoC Suite

Target: browser.zkey0.com  |  Security Research & Bug Bounty Testing

HIGH

UXSS — Universal Cross-Site Scripting

Tests Universal XSS vectors: javascript: URL injection, blob: same-origin bypass, iframe sandbox escapes, history.pushState context confusion, and postMessage origin bypass.

javascript: URL blob: origin iframe escape pushState
Open UXSS PoC
MEDIUM

Address Bar Spoofing

Tests techniques to display a misleading URL in the browser address bar: history.pushState, window.open delayed navigation, blob: URL tricks, and Unicode homograph spoofing.

pushState window.open blob: URL homograph
Open AddressBar PoC
HIGH

Origin Spoofing

Tests origin spoofing via null origin sandboxed iframes, postMessage origin forgery, CORS null-origin bypass, and document.domain relaxation abuse.

null origin postMessage CORS bypass document.domain
Open Origin PoC
For authorized security research only. Deploy on browser.zkey0.com subdomain.