I meant to have a break from the computer on my day off...but I couldn't resist. I've updated my blog with cool effects!

Bypass CSP in a single click using my new Custom Action, powered by @renniepak.nl's excellent CSP bypass project.

Looking for a Christmas gift for yourself? #burp #training #2026 There’s 9 seats left for the English-speaking session, and 5 for the French-speaking one

Meet AutoVader. It automates DOM Invader with Playwright Java and feeds results back into Burp. Faster client side bug hunting for everyone. 🚀 thespanner.co.uk/autovader

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

Delighted to present at NDC Manchester. If you attended the talk and want the materials you can grab them from here: github.com/portswigger/...

Burp Hackvertor has a bunch of new shortcuts and functionality. Try them out in Burp. They are activated from a Burp repeater request.

On Thursday I'm presenting "Splitting the email atom:exploiting parsers to bypass access controls" at NDC Manchester. Please join me if you want to find out how to turn an RFC compliant email address into RCE. portswigger.net/research/tal...

This is the last weekend "JavaScript for hackers" will be available for $13.37. HackFriday! Grab yours now while you can... www.amazon.com/JavaScript-h...

Hackvertor 2.2.33 released! - New MultiEncoder window (CTRL+ALT+M) for applying multiple transformations across layers and sending to Repeater tab - WebSockets support including a WebSocket handler and a new WebSocket setting - Improved auto decoding

HackFriday starts now JavaScript for Hackers is on sale for $13.37 and the deal runs past Hack Friday Boost your payload skills and sharpen your hacking game Grab it while it lasts 🔥 www.amazon.com/JavaScript-h...

If you are planning to buy the paperback version of "JavaScript for hackers" I'd wait till Friday as I'm going to run a promotion for Black Friday. Also it makes a good Christmas present 🎁

Just released a major update to Hackvertor: History logging: your conversions are now replayable and stored in the project file. Tag-Finder window (props to @CoreyD97): filter and insert tags from within the UI. CTRL+ALT+F Lastly: Tab persistence thespanner.co.uk/hackvertor-h...

I'm currently preparing and practicing my talk for NDC Manchester portswigger.net/research/tal...

Demo of the new Shadow Repeater response timing differences.

🚀 Shadow Repeater just got a big upgrade! It now detects response timing differences. thespanner.co.uk/shadow-repea...

Coming to Hackvertor soon... Big thanks to CoreyD97 for the suggestion!

Last chance to catch "Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls" at the NDC Conference, Manchester. Join me and see just how wild the email RFCs really are. portswigger.net/research/tal...

I've just upgraded Turbo Intruder with a shiny new algorithm called HTTP Anomaly Rank, which automatically finds the most unusual responses in your attack! Here's a quick demo, full details in the writeup below: youtu.be/z92GobdN40Y

We've updated our XSS cheat sheet to include 9 new vectors from @garethheyes.co.uk! Here are the top three, you can find the rest here: portswigger.net/web-security...

I only released InsiKt last night, but I've already made a great improvement to row filtering. Filtering 130k entries with regex now takes only 2 seconds! 🔥

This was pretty fun to exploit! Even though I didn't manage to pwn the version used for Pwn2Own Berlin, I still learned a ton about LLMs. Maybe I can get my revenge in future competitions 🤞

Firefox nightly introduces the setHTML() method. Which is like a native DOMPurify. You can easily test it here: portswigger-labs.net/mxss/ Set HTMLSanitizer ✅ Auto update ✅ I'm trying to break it, I encourage you to break it too

New Safari vector: Instead of using window name, I use document.URL to smuggle the payload and the title attribute to create the TypeError XSS. Hash: #'-alert(1)// Poc: portswigger-labs.net/xss/xss.php?...

You can now create private vectors on Shazzer. Useful if you're working on something you're not ready to share yet. shazzer.co.uk/blog/shazzer...

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo: youtu.be/BAZ-z2fA8E4

If you want to learn how to construct epic payloads like this? You need JavaScript for Hackers. Requires this hash: #<img/src/onerror=alert(1)> www.amazon.com/JavaScript-h...

Want to learn how to craft payloads like these? Read JavaScript for Hackers to master creative XSS techniques and understand exactly why they work. 🧠 Learn to think like a hacker ⚡ Master the art of payload design Grab your copy 👉 www.amazon.com/JavaScript-h...

Last chance to catch "Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls" at the NDC Conference, Manchester. Join me and see just how wild the email RFCs really are. portswigger.net/research/tal...

I’m excited to announce that I’ll be presenting The Fragile Lock: Novel Bypasses for SAML Authentication at Black Hat Europe! In this talk, I’ll show how I was able to continuously bypass security patches to achieve complete auth bypass for major libraries. #BHEU @blackhatevents.bsky.social

Anyone in Warsaw left without a ticket to THS yet? I found out I have a discount code :) Come see me next week

In a shameless effort to promote my book. I've crafted some very special vectors for you. If you like them please purchase my book to read more. www.amazon.com/dp/B0BRD9B3GS

Hackvertor v2.1.25 has been released and fixes the content-length problem!

Hackvertor v2.1.24 has a major bug where it doesn't update the content-length. Sorry about that. I've fixed it in v2.1.25. I'll try and get it updated on the BApp store ASAP. Gutted I missed this, sorry I'll try to do better in future.

Did you know you can create AI custom tags in Hackvertor? Did you also know you can actually pass parameters to the AI too? Powerful 🦾 Here's one that creates dummy data: github.com/hackvertor/h... <@_createDummyData(5,'email','...')>gareth</@_createDummyData>

🚀 New Hackvertor Release: v2.1.24 New features - Tag Automator - Context request tag - Find and replace input/output - AI in code custom tags thespanner.co.uk/burp-hackver...

HTTP/1.1 Must Die is coming to #romhack2025 as the keynote! In-person tickets are sold out but you can still watch the livestream. This is your last chance to catch it live - register to watch here: www.youtube.com/watch?v=T009...

Dive into WebSocket Turbo Intruder 2.0 - fuzz at scale, automate complex multi-step attacks, and exploit faster. The blog post is live! Read it here: portswigger.net/research/web...

The recording for my latest research has been released! If you prefer to listen rather than read, now is your chance. P.S. It may be worth listening to it at a slower speed due to my tendency to talk at the speed of light...

I've created a email section on Hackvertor to help with my "Splitting the email atom" attacks. This is a really cool attack that I didn't present a Black Hat. It uses quotes to smuggle an email domain in a SMTP parameter. hackvertor.co.uk/urls/27

Wrote a old school toString obfuscator. hackvertor.co.uk/urls/26

I made creating tags easier in Hackvertor by improving the sample code and adding tag arguments automatically. hackvertor.co.uk/tag-store/new

In web Hackvertor I've added a nest tag which allows you to generate XML/HTML nested tags useful in reaching maximum node nesting limits. E.g. Input: <a>test</a> Output: <a><a><a>test</a></a></a> hackvertor.co.uk/urls/24

We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings: portswigger.net/research/coo...

WAFs still blocking your payloads? Try our newest pointer capture tricks. Our XSS cheat sheet just got an upgrade thanks to Muhammad Ahsan. portswigger.net/web-security...

i've finally got a new blogpost out!! this one talks about modern CSS, it's new features, and practical real world uses as usual, the visuals are css-only and have lots of cool interactivity and easter eggs :3 have fun! lyra.horse/blog/2025/08...

🚀 I’m now accepting GitHub sponsorships! Your support will help cover server costs, fund web security research, and support the maintenance of existing tools (like Hackvertor & Shazzer) as well as the development of new ones. Thank you 💖 github.com/sponsors/hac...

Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission. portswigger.net/web-security...

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

Ever seen two responses to one request? That's just pipelining... or is it? I've just published "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling" portswigger.net/research/how...