The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted! portswigger.net/research/top...

Some sites may use direct IP address today if their domain name servers were not with Cloudflare too! There is this opportunity for WAF bypass... please share it , sharing is caring... 🤗

happy cloudflare outage day to all who celebrate

With cloudflare being down, and as a result, most things I use being down, I came here to say hi 🤭 I guess I will use other AIs than chatgpt today!

These days, I’m off work, busy taking care of a family member, so this really brightened my day and brought a big smile to my face. 😌 thanks @portswigger.net

Did you know? DC4420, the London monthly that graced central London for all of the 10s and before, has a new home and a new date! Greene Man, 383 Euston Road, London, NW1 3AU April 29 Be there. www.eventbrite.co.uk/e/dc4420-apr... has details. you don't have to register. #infosec #security

If you like hacking XML, this article is a gold mine! 😱 It includes parser discrepancies, round-trip attacks and my favorite, namespace confusion 🤩

Congrats to all the winners (especially @orange.tw) and all researchers who made the 2024 long list! 🥂 Thanks for sharing your work with us! 🫡 To readers: Don’t just read the top 10—start there and then explore the rest. There are many great works beyond the top 10, so don’t limit yourself! 🦾

This year two new security legends have joined the top-ten expert panel - @liveoverflow.bsky.social and @stokfredrik.bsky.social! Excited to see what analysis & insights they bring to the top ten alongside long-time contributors @agarri.fr and @irsdl.bsky.social

Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here: portswigger.net/polls/top-10...

Please submit any interesting and especially new web/http related topic published in 2024

If you are using YSoSerial .Net, we have accepted a few PRs and patched several bugs & improved the ViewState plugin! Merry Christmas 🎅 github.com/pwntester/ys...

We are extending our call for papers to January 1, 2025! We are now targeting an end of January release. If you have any Linux/ELF related research, projects, or papers, we would love to publish them! Huge thank you to everyone who has already submitted! tmpout.sh/blog/vol4-cf...

It seems Bsides Birmingham is now happening: www.bsidesbrum.com CFP is also open! 😎

Currently at #BSidesLDN2024 @n1ckdunn.bsky.social

🔥 Get ready for the biggest #SecuriTay yet! 🔥 🦄 500 attendees 🎮 2-day CTF 🤝 Multiple sponsors 📅 Happening 28 | 02 | 2025 - First ticket drop coming soon! 👀 More details at securi-tay.co.uk

Extended the starter with shy writers! 😀 If you're not on the list but write about web security, then feel free to reply with the article you're most proud of, and I will add you to the pack! Make sure to resubscribe to not not miss on the amazing 🌐research! go.bsky.app/9JXnB17

I've released 'brainstorm': an alternative way to do web fuzzing combining my fav fuzzing tool 'ffuf' (from @joohoi.bsky.social )with local LLMs (via Ollama API) to generate smarter filename tests. It usually finds more endpoints with fewer requests. Added a IIS shortname support @irsdl.bsky.social

The "bug bounty hunters and content creators" starter pack is now up to 60 users! Follow this to get instantly connected to the bug bounty community & let me know if I've missed you off! go.bsky.app/GD7hKPX

Any bug bounty people around? I'm creating a starter pack of people to follow but it's pretty brief currently! Let me know if you'd like to be added: go.bsky.app/GD7hKPX

If you ever find yourself investigating random docker images, dive (github.com/wagoodman/dive) is amazingly useful. It lets you see which files changed in each filesystem layer. I've used it to spot config files accidentally left in images :)

That’s what App Passwords are made for 🔒 Go to "Settings > Advanced > App Passwords" to create one for each 3rd-party app You can login with your handle and this specific password ✅

The best we have right now in the "My pins" feed You reply with a pin emoji to the post you want to bookmark And the feed shows all your messages containing a pin bsky.app/profile/josh...

I wish I had the bookmark ability here as well. Any pointers?

As there's more people showing up here who are into Web Application Security and I couldn't find an existing starter pack for it, I decided to create one :) If you do webappsec stuff and want added ping me :) go.bsky.app/NB1hgC

Sharpener was forked in June. It's sill maintained by irsdl, but it isn't a MDSec project anymore. The BappStore switched to the fork and currently hosts v3.6, but you can get the latest version (v3.9) directly from Github.