When looking for postMessage vulnerabilities, the FancyTracker Firefox extension can be very useful. It has built-in syntax highlighting and sortes out duplicates. Check it out 👇 https://github.com/Zeetaz/FancyTracker-FF And the original for Chrome: https://github.com/fransr/postMessage-tracker

Your weekly reminder to migrate from rs/cors to jub0bs/cors. 😇 github.com/rs/cors/issu...

Desync issues are so finicky which is exceptionally fun. I really love the fact that at any point "you might be 1 byte away from a desync". However, you can also be a few hundred connections in turbo-intruder away from a desync as it turns out. If in doubt, (carefully) increase your connection pool.

🚀 Shadow Repeater just got a big upgrade! It now detects response timing differences. thespanner.co.uk/shadow-repea...

After the whole... Expect breaks the internet debacle (not that this is past tense, it clearly still does) I was pretty sure another header was gonna be useful for desync things... Today, I think I actually have an exploit that works specifically due to that header's weirdness. 🔥

I've just upgraded Turbo Intruder with a shiny new algorithm called HTTP Anomaly Rank, which automatically finds the most unusual responses in your attack! Here's a quick demo, full details in the writeup below: youtu.be/z92GobdN40Y

We've updated our XSS cheat sheet to include 9 new vectors from @garethheyes.co.uk! Here are the top three, you can find the rest here: portswigger.net/web-security...

Those who are monitoring academic research paper releases. How? Google scholar alerts seems okay? Trying to build-up my daily research consumption feeds. (Would be convenient if there was an RSS feed somewhere)

Long overdue, but I rewrote Logger++ to be more memory efficient and fix all the bugs! github.com/CoreyD97/Ins...

my #39c3 talk got accepted!! see you at @ccc.de in december ^^ (yes, it will be livestreamed and recorded)

Well then... I can tell by looking at the vulnerable domains that this is working. Interestingly, the PDS scan may be identifying things my own tool has missed. Even if not, its ability to go ahead and try out 0.CL / CL.0 is super fancy. I suspect I'll submit a pull request when the time is right 😁

I often end up re-watching research presentations because I'm terrible at absorbing new information the first time around. This has so often given me a new lead or idea for a tweak in my tooling, that I often re-watch them on a whim even when I'm fairly sure I've understood 100% of the content.

Expect is the gift that just keeps on giving. It's almost never consistent, but it's almost always interesting behaviour...

Found an XSS but got blocked by the CSP? https://cspbypass.com has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

For every BB response that is a bit sad. There's a program that pays out, and is happy to help support your research presentation by being name-dropped. Super hyped for this one!

The official @defcon recording of HTTP/1.1 Must Die has landed - join me on the mission to help kill HTTP/1.1! www.youtube.com/watch?v=PUCy...

Want to learn how to craft payloads like these? Read JavaScript for Hackers to master creative XSS techniques and understand exactly why they work. 🧠 Learn to think like a hacker ⚡ Master the art of payload design Grab your copy 👉 www.amazon.com/JavaScript-h...

Last chance to catch "Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls" at the NDC Conference, Manchester. Join me and see just how wild the email RFCs really are. portswigger.net/research/tal...

The recording of "HTTP/1.1 must die: the desync endgame" has now landed on YouTube. Enjoy! www.youtube.com/watch?v=zr5y...

I’m excited to announce that I’ll be presenting The Fragile Lock: Novel Bypasses for SAML Authentication at Black Hat Europe! In this talk, I’ll show how I was able to continuously bypass security patches to achieve complete auth bypass for major libraries. #BHEU @blackhatevents.bsky.social

I cannot get over how bonkers the HEAD technique is in relation to desync vulns. I've never gotten a chance to use it in a real-word situation, but finally had a chance this week. Not only does it produce some serious impact, it also just looks incomprehensibly cool when it finally works.

Correction the issue was cross-domain related. BUT fetch followed by a location change now doesn't reuse a connection... Both requests are towards the same domain.

Why would chrome not reuse a connection when two requests are triggered from a script, but WILL reuse a connection when it's all done via the console! Same script, just with <script> tags breaks things...

One hour till HTTP/1.1 Must Die kicks off at #romhack2025! Watch the livestream here: m.youtube.com/watch?v=T009...

Episode 20: War Stories with Julien Richard! @tib3rius.bsky.social & @swiftsecur.bsky.social chat with Julien Richard about his war stories! Thank you to @portswigger.net for sponsoring today's episode! Check out portswigger.net/burp/ai to learn more about AI in Burp Suite. Links below!

First big oof of the research today. Program has set one of our coolest PoCs so far to informative. Fortunately, it's so cool that we will absolutely be talking about how it all played at some point. "The technique is what matters", it's still an awesome slide 🔥

Twitter has schooled me on this. Don't interpret it as a universal bypass because it is not! Nevertheless, this very silly bypass works on some large groups of customers implementing bad rules...

My first post for the @ctbbpodcast.bsky.social Research Lab is live. Super excited to be part of this team, can't wait to see what crazy research is gonna come from this! lab.ctbb.show/research/Exp...

HTTP/1.1 Must Die is coming to #romhack2025 as the keynote! In-person tickets are sold out but you can still watch the livestream. This is your last chance to catch it live - register to watch here: www.youtube.com/watch?v=T009...

Dive into WebSocket Turbo Intruder 2.0 - fuzz at scale, automate complex multi-step attacks, and exploit faster. The blog post is live! Read it here: portswigger.net/research/web...

Pretty sure I just found a hilarious bypass for this... If this works then all those hosts that sit behind Akamai are suddenly much more viable targets.

Another day, another block from Akamai briefly making me think a new bit of detection is breaking the internet 😅. It's my own fault, I have a "Filter WAF" option that I didn't turn on.

WebSocket security testing is so painful that this ever -expanding attack surface is largely overlooked. Learn how to dive where others fear to tread with WebSocket Turbo Intruder. Join me live on Sept 17 at 4PM (GMT+1) discord.gg/portswigger?...

For a visual walk‑through, see the @steelcon.info livestream recording: youtu.be/wxu1axAdPhw?...

We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings: portswigger.net/research/coo...

There’s a solid chance that with just a few lines of code, the new parser discrepancy scan can entirely replace the tool I’ve been working on for my own research… I am not sure how to feel about this 😁 Good news is that the scan is insanely easy to augment with new techniques!

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

Ever seen two responses to one request? That's just pipelining... or is it? I've just published "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling" portswigger.net/research/how...

"This strategy creates an avalanche of desync research leads" is somehow an understatement. Take Smuggler for a spin on your largest burp file right now and just watch the issue counter 🔥. If you want even more results, adding new headers / perms looks to be trivial (it's one line of code).

Just spent the last two days taking any moment I had of freedom to try and solve the new 0.CL lab before the solution is released… it’s possible I over complicated it slightly 👌. Awesome technique, I’ll hopefully be releasing some material on the whole talk soon also! 🔥

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

It’s Defcon travel day today! Mega excited for an enormous number of reasons. If all goes well, many of them will become apparent roughly two weeks after it all ends…

I've gotten so lost in working on detection techniques that I've forgotten about a few very valid looking cases I found with the initial probe. 😄 Good news is, the tool looks like it might actually be useful regardless of what happens. But I guess I should focus on getting some exploits...

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

Not yet sure on how API access works yet, but a new online subdomain lookup service has arrived. subintel.tushal.io, seems pretty great!

Everything I do leads me back to param-miner 😁. What a tool ⛏️

This is pretty cool. Things start getting really confusing when you look into the chunk extensions so... this is a huge help!

You're not ready for how powerful Custom Actions are. You can now build your own AI hacking sidekicks that rewrite requests for you. Forget typing payloads - just let your assistant do it. 🔥 Welcome to the future of offensive automation. Get the source code: github.com/PortSwigger/...

New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking...

Manual testing doesn't have to be repetitive. Meet Repeater Strike - an AI-powered Burp Suite extension that turns your Repeater traffic into a scan check. Source code: github.com/hackvertor/r... Blog post: portswigger.net/research/rep...