James Kettle
@jameskettle.com
📤 4386
📥 133
📝 229
Director of Research at
@portswigger.net
Also known as albinowax Portfolio:
https://jameskettle.com/
pinned post!
Hi all! I'll be posting about web security research. You can find a curated list of my past research, tools & presentations at
https://jameskettle.com/
loading . . .
James Kettle research portfolio
https://jameskettle.com
over 2 years ago
0
26
1
reposted by
James Kettle
Gareth Heyes
13 days ago
🚀 Shadow Repeater just got a big upgrade! It now detects response timing differences.
thespanner.co.uk/shadow-repea...
loading . . .
Shadow Repeater v1.2.3 release - The Spanner
The new version of Shadow Repeater has been released with a couple of cool new features. Timing differences Shadow Repeater analyses your Repeater requests and looks for response differences but it wa...
https://thespanner.co.uk/shadow-repeater-v123-release
0
5
2
I've just upgraded Turbo Intruder with a shiny new algorithm called HTTP Anomaly Rank, which automatically finds the most unusual responses in your attack! Here's a quick demo, full details in the writeup below:
youtu.be/z92GobdN40Y
loading . . .
HTTP Anomaly Rank - a new Turbo Intruder feature
YouTube video by PortSwigger
https://youtu.be/z92GobdN40Y
20 days ago
2
13
5
reposted by
James Kettle
PortSwigger Research
21 days ago
We've updated our XSS cheat sheet to include 9 new vectors from
@garethheyes.co.uk
! Here are the top three, you can find the rest here:
portswigger.net/web-security...
3
176
20
Google Cloud Platform was vulnerable to a HTTP desync attack leading to "responses being misrouted between recipients for certain third-party models". Aka your LLM response goes to someone else. The Expect header strikes again! Context:
http1mustdie.com
cloud.google.com/support/bull...
loading . . .
Security Bulletins | Customer Care | Google Cloud
https://cloud.google.com/support/bulletins#gcp-2025-059
about 1 month ago
0
14
5
HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:
youtu.be/BAZ-z2fA8E4
loading . . .
HTTP is supposed to be stateless...
YouTube video by PortSwigger
https://youtu.be/BAZ-z2fA8E4
about 1 month ago
1
22
6
The official @defcon recording of HTTP/1.1 Must Die has landed - join me on the mission to help kill HTTP/1.1!
www.youtube.com/watch?v=PUCy...
loading . . .
DEF CON 33 - HTTP 1 1 Must Die! The Desync Endgame - James 'albinowax' Kettle
YouTube video by DEFCONConference
https://www.youtube.com/watch?v=PUCyExOr3sE
about 2 months ago
0
5
1
The recording of "HTTP/1.1 must die: the desync endgame" has now landed on YouTube. Enjoy!
www.youtube.com/watch?v=zr5y...
loading . . .
RomHack 2025 - James “albinowax” Kettle - HTTP/1.1 Must Die! The Desync Endgame
YouTube video by Cyber Saiyan
https://www.youtube.com/watch?v=zr5y6Bapbnw&list=PLoX0sUafNGbEkK0ai5P_DB2HDnljRAJyZ&index=1
about 2 months ago
1
15
3
reposted by
James Kettle
d4d
about 2 months ago
I’m excited to announce that I’ll be presenting The Fragile Lock: Novel Bypasses for SAML Authentication at Black Hat Europe! In this talk, I’ll show how I was able to continuously bypass security patches to achieve complete auth bypass for major libraries.
#BHEU
@blackhatevents.bsky.social
0
26
6
It was an absolute privilege to present at
#RomHack2025
with such a vibrant and welcoming community! Thanks to everyone who said hi and shared your stories!
2 months ago
1
12
0
One hour till HTTP/1.1 Must Die kicks off at
#romhack2025
! Watch the livestream here:
m.youtube.com/watch?v=T009...
loading . . .
RomHack Conference 2025 Live Stream
YouTube video by Cyber Saiyan
https://m.youtube.com/watch?v=T009mzzoxvs
2 months ago
0
13
2
I'm flying out to
#romhack2025
tomorrow, for the final edition of HTTP/1.1 Must Die! Feel free to say hi if you'd like to chat.
2 months ago
0
12
0
HTTP/1.1 Must Die is coming to
#romhack2025
as the keynote! In-person tickets are sold out but you can still watch the livestream. This is your last chance to catch it live - register to watch here:
www.youtube.com/watch?v=T009...
loading . . .
RomHack Conference 2025 Live Stream
YouTube video by Cyber Saiyan
https://www.youtube.com/watch?v=T009mzzoxvs
2 months ago
0
9
4
reposted by
James Kettle
d4d
2 months ago
Dive into WebSocket Turbo Intruder 2.0 - fuzz at scale, automate complex multi-step attacks, and exploit faster. The blog post is live! Read it here:
portswigger.net/research/web...
loading . . .
WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine
Many testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi
https://portswigger.net/research/websocket-turbo-intruder-nbsp-unearthing-the-websocket-goldmine
0
13
6
reposted by
James Kettle
Compass Security
3 months ago
We use
@jameskettle.com
Burp extension Collaborator Everywhere daily. Now our upgrades are in v2: customizable payloads, storage, visibility. Perfect for OOB bugs like SSRF. Find out more here:
blog.compass-security.com/2025/09/coll...
#AppSec
#BurpSuite
#Pentesting
0
8
6
reposted by
James Kettle
d4d
3 months ago
We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings:
portswigger.net/research/coo...
loading . . .
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve
https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes
1
13
14
reposted by
James Kettle
Gareth Heyes
3 months ago
Imagine you have a XSS vulnerability but you have a undefined variable before your injection. Is all hope lost? Not at all you can use a technique called XSS Hoisting to declare the variable and continue your exploit. Thanks to ycam_asafety for the submission.
portswigger.net/web-security...
2
15
6
When I condense nine months of research discoveries into a 40-min talk, it can make it seem easy. For a taster of the true experience, watch my battle to solve the 0-CL @WebSecAcademy lab! Research is persistence.
www.youtube.com/live/B7p8dIB...
loading . . .
Novel HTTP/1 Request Smuggling/Desync Attacks with James Kettle
YouTube video by Off By One Security
https://www.youtube.com/live/B7p8dIB7bFg
3 months ago
0
12
4
I just published a Repeater feature to make it easier to explore request smuggling. It repeats your request until the status code changes. It's called "Retry until success" and you can install it via the Extensibility helper bapp.
3 months ago
1
14
5
Ever seen two responses to one request? That's just pipelining... or is it? I've just published "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling"
portswigger.net/research/how...
loading . . .
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real
https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling
3 months ago
0
13
6
reposted by
James Kettle
Thomas Stacey
4 months ago
"This strategy creates an avalanche of desync research leads" is somehow an understatement. Take Smuggler for a spin on your largest burp file right now and just watch the issue counter 🔥. If you want even more results, adding new headers / perms looks to be trivial (it's one line of code).
0
4
1
Massive thanks to everyone who came to watch HTTP/1.1 Must Die at Black Hat USA & DEF CON! It was great to meet you all and hear your stories, had an absolute blast and I'm psyched to cook up some more madness for next year!
4 months ago
0
16
0
You can currently watch http/1.1 must die here! Note the link will expire at some point.
m.youtube.com/watch?v=ssln...
loading . . .
DEFCON 33: Track 1 Talks
YouTube video by DEFCONConference
https://m.youtube.com/watch?v=sslnkb4MnTg&t=25152s&pp=2AHAxAGQAgE%3D
4 months ago
0
11
4
Watch HTTP/1.1 Must Die live today at 1630 PST! - In person at
#defcon33
track 1, main stage - Livestream via YouTube:
www.youtube.com/watch?v=ssln...
4 months ago
2
7
2
The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die:
http1mustdie.com
loading . . .
HTTP/1.1 Must Die
Upstream HTTP/1.1 is inherently insecure, and routinely exposes millions of websites to hostile takeover. Join the mission to kill HTTP/1.1 now
https://http1mustdie.com/
4 months ago
0
40
24
At
#BlackHat
? Catch "HTTP/1.1 Must Die! The Desync Endgame" today at 3:20 in Oceanside A, Level 2. Hope to see you there!
4 months ago
0
8
1
Let me know if you'd like to chat research at Black Hat or
#defcon33
! Also feel free to say hi if you see me about, I've got a not-very-subtle laptop cover to aid recognition 😂
4 months ago
0
11
1
Not at Black Hat / DEF CON? You can still join the mission to kill HTTP/1.1: - Watch the livestream from
#DEFCON
at 16:30 PT on the 8th - Read the whitepaper on our website - Grab the HTTP Request Smuggler update & WebSecAcademy lab Follow for updates & links. It's nearly time!
loading . . .
Upcoming Conference Talks - PortSwigger Research
Find details of upcoming talks from the PortSwigger Research team. We also have research papers and recordings available from previous conferences and events.
https://portswigger.net/research/talks?talkId=32
4 months ago
0
12
2
Our core website uses HTTP/2 end to end, but for maximum irony http1mustdie[.]com is stuck using HTTP/1.1 upstream due to AWS CloudFront limitations! However it's in scope for our bounty program... and if you manage to exploit it with HTTP request smuggling, we'll pay a bonus :)
4 months ago
0
10
4
Ever seen a header injection where achieving a desync seemed impossible? I think I've finally identified the cause - nginx doesn't reuse upstream connections by default, and often has header injection. This means you're left with a blind request tunneling vulnerability 👇
4 months ago
1
8
0
You know those non-vulnerabilities that companies get forced to fix for compliance reasons? I've found a full bypass for a common patch strategy. I'm half-tempted to keep it secret for the greater good 😂
4 months ago
0
11
0
reposted by
James Kettle
Gareth Heyes
4 months ago
Is your target leaking CSP violations left and right? Mikhail Khramenkov reveals how to hijack the onsecuritypolicyviolation event to trigger JS in hidden inputs - when unsafe-inline is in play and styles are blocked. Now live on our XSS cheat sheet.
portswigger.net/web-security...
1
9
2
reposted by
James Kettle
Pieter Hiele
4 months ago
Now live on
tools.honoki.net/smuggler.html
Let me know what you think! ✨
add a skeleton here at some point
0
28
13
reposted by
James Kettle
Alex Chapman
4 months ago
There are bad security takes, and then there is
@daniel.haxx.se
attempting to shame
@jameskettle.com
for not "responsibly disclosing" a vulnerability to the curl project that doesn't affect the curl project... and _then_ complaining the details are being kept "secret" :facepalm:
loading . . .
daniel:// stenberg:// (@
[email protected]
)
@
[email protected]
@
[email protected]
@
[email protected]
the website, the naming, the scare, the secrecy
https://mastodon.social/@bagder/114890176383466057
2
8
2
It's easy to bash vulnerabilities with logos but... I couldn't resist, say hello to
http1mustdie.com
:)
5 months ago
2
13
3
reposted by
James Kettle
0x999
5 months ago
New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @
0x999.net/blog/leaking...
loading . . .
Leaking IPs in Brave Tor Window & Chrome VPNs + Popunders + CSP Bypass
This writeup details multiple IP leak vulnerabilities I discovered affecting Brave's Tor window and Chrome VPN extensions that allowed a malicious actor to leak the real IP address of any visitor to a...
https://0x999.net/blog/leaking-ips-in-brave-tor-window-chrome-vpns-popunders-csp-bypass
0
5
5
reposted by
James Kettle
Gareth Heyes
5 months ago
Manual testing doesn't have to be repetitive. Meet Repeater Strike - an AI-powered Burp Suite extension that turns your Repeater traffic into a scan check. Source code:
github.com/hackvertor/r...
Blog post:
portswigger.net/research/rep...
loading . . .
0
8
2
We've just released a massive update to Collaborator Everywhere! This is a complete rewrite by
@compass-security.com
which adds loads of features including in-tool payload customization. Massive thanks to Compass for this epic project takeover. Check out the new features:
5 months ago
1
19
8
How to make $$$ from request smuggling Step 1) Pick the right target:
5 months ago
2
29
2
reposted by
James Kettle
Geluchat
5 months ago
Today was my last day as a pentester at Bsecure. After a three-year journey of hunting on the side, I’m ready to go all-in as a full-time bug bounty hunter. You can read about my journey from pentester to full-time hunter here:
gelu.chat/posts/from-p...
loading . . .
Finding Freedom, One Bug at a Time: My Journey from Pentester to Full-Time Hunter
After seven years in pentesting, I transitioned full-time into bug bounty hunting, leveraging deep experience and continuous learning. This article shares key moments and insights from that journey.
https://gelu.chat/posts/from-pentester-to-fulltime-hunter
3
23
7
reposted by
James Kettle
Robert Merget (ic0ns)
5 months ago
We found a new vulnerability in TLS. It's a variant of the ALPACA attack that bypasses current countermeasures. Relativly low impact - but great insight! Check it out:
opossum-attack.com
1
11
8
reposted by
James Kettle
Jorian
5 months ago
Here's my writeup the technique allowing some nonce-based CSPs to be bypassed. I think it definitely has some practical use, so included some details about different scenario's. Don't let that HTML-injection of yours wait!
jorianwoltjer.com/blog/p/resea...
loading . . .
Nonce CSP bypass using Disk Cache | Jorian Woltjer
The solution to my small XSS challenge, explaining a new kind of CSP bypass with browser-cached nonces. Leak it with CSS and learn about Disk Cache to safely update your payload
https://jorianwoltjer.com/blog/p/research/nonce-csp-bypass-using-disk-cache
3
15
6
Interested in pushing hacking techniques beyond the state of the art, or breaking into full-time security research? I recently had a great chat with Tib3rius on the topic! Watch it here:
www.youtube.com/watch?v=S64E...
loading . . .
Getting Into Cybersecurity - An Interview with James Kettle!
YouTube video by Tib3rius
https://www.youtube.com/watch?v=S64Eq0Y3SrY
5 months ago
1
11
4
This talk will mark a personal milestone - my tenth presentation at Black Hat USA! Feels lke yesterday I stepped on stage to present Server-Side Template Injection and introduced the now-endemic {{7*7}}. Never thought I'd make it this far, let's see what the next ten years hold!
add a skeleton here at some point
5 months ago
0
17
1
reposted by
James Kettle
d4d
5 months ago
Thrilled to announce: I’ll be presenting a major new version of WebSocket Turbo Intruder at Black Hat Arsenal 2025! This open-source toolkit makes high-speed, advanced WebSocket attacks practical and painless.
1
9
3
Concerned about LLM-powered pentesters stealing your job? We've made improving your workflow with AI easier than ever - you can now build your own AI features directly inside Repeater with Custom Actions. Here's one I built for myself:
5 months ago
2
6
1
The upcoming "HTTP/1 must die" WebSecAcademy lab is no longer impossible! This is good news because I'm planning to attempt to live-stream solving it...
5 months ago
0
10
1
Now I just need to turn my 20gb Burp Suite project file with 73,000 Organizer entries into an enticing slide deck 😂
add a skeleton here at some point
6 months ago
1
24
0
I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to
#DEFCON33
! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!
6 months ago
0
43
12
reposted by
James Kettle
Mastering Burp Suite
6 months ago
The Scalpel extension is magic 🪄 Especially if you're a big fan of executing both python3 and vim within Burp Suite 🛠️
blog.lexfo.fr/scalpel.html
1
7
4
reposted by
James Kettle
Gareth Heyes
6 months ago
Epic Firefox XSS vectors by Masato Kinugawa. Now available on our XSS cheat sheet including variants found by me. Link to vectors👇
portswigger.net/web-security...
0
11
4
Load more
feeds!
log in