Category: PortSwigger
Imagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview,…
URL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection….
Last year Johan Carlsson discovered you could conceal payloads inside the credentials part of the URL . This was fascinating…
The strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s…
HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In…
In this post, I will introduce the “cookie sandwich” technique which lets you bypass the HttpOnly flag on certain servers….
Unicode codepoint truncation – also called a Unicode overflow attack – happens when a server tries to store a Unicode…
Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify…
Have you ever wondered how many vulnerabilities you’ve missed by a hair’s breadth, due to a single flawed choice? We’ve…
Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access…
Tired of repeating yourself? Automate your web security audit trail. In this post I’ll introduce a new Burp AI extension…
Control characters like SOH, STX, EOT and ETX were never meant to run your code – but in the world…