I cannot get over how bonkers the HEAD technique is in relation to desync vulns. I've never gotten a chance to use it in a real-word situation, but finally had a chance this week. Not only does it produce some serious impact, it also just looks incomprehensibly cool when it finally works.

Correction the issue was cross-domain related. BUT fetch followed by a location change now doesn't reuse a connection... Both requests are towards the same domain.

Why would chrome not reuse a connection when two requests are triggered from a script, but WILL reuse a connection when it's all done via the console! Same script, just with <script> tags breaks things...

One hour till HTTP/1.1 Must Die kicks off at #romhack2025! Watch the livestream here: m.youtube.com/watch?v=T009...

Episode 20: War Stories with Julien Richard! @tib3rius.bsky.social & @swiftsecur.bsky.social chat with Julien Richard about his war stories! Thank you to @portswigger.net for sponsoring today's episode! Check out portswigger.net/burp/ai to learn more about AI in Burp Suite. Links below!

First big oof of the research today. Program has set one of our coolest PoCs so far to informative. Fortunately, it's so cool that we will absolutely be talking about how it all played at some point. "The technique is what matters", it's still an awesome slide 🔥

Twitter has schooled me on this. Don't interpret it as a universal bypass because it is not! Nevertheless, this very silly bypass works on some large groups of customers implementing bad rules...

My first post for the @ctbbpodcast.bsky.social Research Lab is live. Super excited to be part of this team, can't wait to see what crazy research is gonna come from this! lab.ctbb.show/research/Exp...

HTTP/1.1 Must Die is coming to #romhack2025 as the keynote! In-person tickets are sold out but you can still watch the livestream. This is your last chance to catch it live - register to watch here: www.youtube.com/watch?v=T009...

Dive into WebSocket Turbo Intruder 2.0 - fuzz at scale, automate complex multi-step attacks, and exploit faster. The blog post is live! Read it here: portswigger.net/research/web...

Pretty sure I just found a hilarious bypass for this... If this works then all those hosts that sit behind Akamai are suddenly much more viable targets.

Another day, another block from Akamai briefly making me think a new bit of detection is breaking the internet 😅. It's my own fault, I have a "Filter WAF" option that I didn't turn on.

WebSocket security testing is so painful that this ever -expanding attack surface is largely overlooked. Learn how to dive where others fear to tread with WebSocket Turbo Intruder. Join me live on Sept 17 at 4PM (GMT+1) discord.gg/portswigger?...

For a visual walk‑through, see the @steelcon.info livestream recording: youtu.be/wxu1axAdPhw?...

We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings: portswigger.net/research/coo...

There’s a solid chance that with just a few lines of code, the new parser discrepancy scan can entirely replace the tool I’ve been working on for my own research… I am not sure how to feel about this 😁 Good news is that the scan is insanely easy to augment with new techniques!

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

Ever seen two responses to one request? That's just pipelining... or is it? I've just published "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling" portswigger.net/research/how...

"This strategy creates an avalanche of desync research leads" is somehow an understatement. Take Smuggler for a spin on your largest burp file right now and just watch the issue counter 🔥. If you want even more results, adding new headers / perms looks to be trivial (it's one line of code).

Just spent the last two days taking any moment I had of freedom to try and solve the new 0.CL lab before the solution is released… it’s possible I over complicated it slightly 👌. Awesome technique, I’ll hopefully be releasing some material on the whole talk soon also! 🔥

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

It’s Defcon travel day today! Mega excited for an enormous number of reasons. If all goes well, many of them will become apparent roughly two weeks after it all ends…

I've gotten so lost in working on detection techniques that I've forgotten about a few very valid looking cases I found with the initial probe. 😄 Good news is, the tool looks like it might actually be useful regardless of what happens. But I guess I should focus on getting some exploits...

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

Not yet sure on how API access works yet, but a new online subdomain lookup service has arrived. subintel.tushal.io, seems pretty great!

Everything I do leads me back to param-miner 😁. What a tool ⛏️

This is pretty cool. Things start getting really confusing when you look into the chunk extensions so... this is a huge help!

You're not ready for how powerful Custom Actions are. You can now build your own AI hacking sidekicks that rewrite requests for you. Forget typing payloads - just let your assistant do it. 🔥 Welcome to the future of offensive automation. Get the source code: github.com/PortSwigger/...

New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking...

Manual testing doesn't have to be repetitive. Meet Repeater Strike - an AI-powered Burp Suite extension that turns your Repeater traffic into a scan check. Source code: github.com/hackvertor/r... Blog post: portswigger.net/research/rep...

Submitted a second case based on the same research lead, this time using a technique I've not personally seen before to achieve a desync and a completely accidental exploit chain to achieve impact. Should make for a fun story even if this lead doesn't continue to produce results 🔥

🧠 CORS misconfigurations are sneaky. Want to catch them with static analysis? Kevin Stubbings from GitHub Security Lab shows how to model CORS middleware in CodeQL—using Go’s Gin framework as a case study. Great insights for researchers & devs: github.blog/security/app...

🔥 Want to think like a hacker and truly understand JavaScript? 💻 JavaScript for Hackers is your guide to breaking, bending, and mastering the language like never before.

Close enough! AMA: docs.google.com/forms/d/e/1F... I'll do a live stream answering questions some time soon :)

Here's my writeup the technique allowing some nonce-based CSPs to be bypassed. I think it definitely has some practical use, so included some details about different scenario's. Don't let that HTML-injection of yours wait! jorianwoltjer.com/blog/p/resea...

New video! Getting Into Cybersecurity - An Interview with James Kettle! In this episode, James Kettle talks about how he got started in security research, and how you can pivot into this rare but worthwhile role. Watch now: youtu.be/S64Eq0Y3SrY Listen on Spotify: open.spotify.com/show/5m5711J...

Interested in pushing hacking techniques beyond the state of the art, or breaking into full-time security research? I recently had a great chat with Tib3rius on the topic! Watch it here: www.youtube.com/watch?v=S64E...

Nginx normalizes paths (/../, %2e, etc.) before applying access rules like: location = /admin { deny all; } But backends like Node.js or PHP handle decoding again, and differently.

Building detection techniques is an underrated part of research for me. I imagine working on solid detection code for a DAST scanner would be fun. Today I made a small change based on a particularly sensitive header and suddenly a bunch of new cases popped up in, critically, a different tech stack.

Thrilled to announce: I’ll be presenting a major new version of WebSocket Turbo Intruder at Black Hat Arsenal 2025! This open-source toolkit makes high-speed, advanced WebSocket attacks practical and painless.

So I guess I'm hitting some kind of CDN or an intermediary that serves many many different backends. I don't have much experience of RQP at this scale, but I am definitely getting responses from multiple different applications. It's absolutely terrifying.

First full research week in a while... Starting to look for a new topic. One of the first leads I had has just produced a full-blown RQP vulnerability. Today was a good day 🔥

I wanted to learn web sockets. So I built a hacking rooms! You can now connect multiple browsers and use HackPad to test HTML. You'll get a message with every browser connected. It even goes red when you call alert() from a different browser :D hackvertor.co.uk/hack-pad/hac...

Here I use a Hacking room in Hackvertor to find bugs in Chrome and Safari. I basically connect Firefox, Safari and Chrome and try a SVG vector. Firefox escapes correctly whereas Chrome and Safari don't. Chrome executes the alert and Safari goes red to indicate it did too.

Our very own penetration tester and security researcher Thomas Stacey wrote a paper on his research into request tunneling which got some real traction. Very interesting read! www.assured.se/posts/the-si...

SQL Injection despite using prepared statements? 🧐 Turns out that SQL syntax can be ambiguous! Learn how this has led to vulnerabilities in several popular PostgreSQL client libraries: www.sonarsource.com/blog/double-... #appsec #security #vulnerability

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!

Thomas Stacey presenting ”The Single Packet Shovel” at OWASP Gothenburg hosted by @assuredab.bsky.social

Active Scan++ just got sharper - we’ve added new checks for OS command injection, powered by our latest ASCII Control Characters research. Install via Extensions -> BApp Store

The recording of my recent AMA with the Burp Suite Discord community has just landed on YouTube! 40 minutes of unscripted Q&A on security research, AI, and Burp Suite: youtu.be/mgmUZ9odkvU