Introducing HTTP Anomaly Rank
If you’ve ever used Burp Intruder or Turbo Intruder, you’ll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting…
Category: PortSwigger
Top 10 web hacking techniques of 2025
Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web…
We’re going teetotal: It’s goodbye to The Daily Swig
PortSwigger today announces that The Daily Swig is closing down Over the past five-and-a-half years, The Daily Swig has provided an independent and high-quality perspective…
Indian transport ministry flaws potentially allowed creation of counterfeit driving licenses
Charlie Osborne 28 February 2023 at 14:15 UTC Updated: 28 February 2023 at 14:51 UTC Armed with personal data fragments, a researcher could also access…
Password managers: A rough guide to enterprise secret platforms
The second part of our password manager series looks at business-grade tech to handle API tokens, login credentials, and more Modern enterprises run dozens (and…
Chromium bug allowed SameSite cookie bypass on Android devices
Protections against cross-site request forgery could be bypassed A recently patched bug in the Chromium project could allow malicious actors to bypass a security feature…
Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption
Jessica Haworth 24 February 2023 at 13:09 UTC Updated: 24 February 2023 at 13:15 UTC Your fortnightly rundown of AppSec vulnerabilities, new hacking techniques, and…
NIST plots biggest ever reform of Cybersecurity Framework
CSF 2.0 blueprint offered up for public review ANALYSIS The US National Institute of Standards and Technology (NIST) is planning significant changes to its Cybersecurity…
Cisco ClamAV anti-malware scanner vulnerable to serious security flaw
Patch released for bug that poses a critical risk to vulnerable technologies A security flaw in a bundle anti-malware scanner product has created a serious…
CVSS system criticized for failure to address real-world impact
JFrog argues vulnerability risk metrics need complete revamp ANALYSIS Weaknesses in the existing CVSS scoring system have been highlighted through new research, with existing metrics…
‘Most web API flaws are missed by standard security tests’ – Corey J Ball on securing a neglected attack vector
API security is a ‘great gateway’ into a pen testing career, advises specialist in the field INTERVIEW Securing web APIs requires a different approach to…
HTTP request smuggling bug patched in HAProxy
Ben Dickson 17 February 2023 at 16:05 UTC Updated: 17 February 2023 at 16:07 UTC Exploitation could enable attackers to access backend servers HAProxy, the…