PortSwigger Research

Web hacking techniques of 2021

Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year

HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections

In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.

Microsoft pushes ahead with controversial ‘buy now, pay later’ feature for Edge

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

uBlock, I exfiltrate: exploiting ad blockers with CSS

Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that

Researchers exploit HTTP/2, WPA3 protocols to stage ‘timeless timing’ attacks

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

HTTP/3: Everything you need to know about the next-generation web protocol

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

VPN users unmasked by zero-day vulnerability in Virgin Media routers

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Developers fix multitude of vulnerabilities in Apache HTTP Server

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Listen to the whispers: web timing attacks that work

Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets

Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

OAuth 2.0 Authentication Vulnerabilities

While browsing the web, you've almost certainly come across sites that let you log in using your social media account. The chances are that this feature is ...

OPPA: Ohio could become the third US state to enact a new consumer privacy law

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

New differential fuzzing tool reveals novel HTTP request smuggling techniques

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Belgium launches nationwide safe harbor for ethical hackers

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Practical Web Cache Poisoning

In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems

An overview of the top web hacking techniques of 2017

The verdict is in! Following 37 nominations whittled down to a shortlist of 15 by a community vote, our panel of experts has conferred and selected the top 10 web hacking techniques of 2017 (and 2016)

Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

HAProxy vulnerability enables HTTP request smuggling attacks

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Smashing the state machine: the true potential of web race conditions

For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding

OAuth Attack Vectors

Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an

CSS: The bomb inside your inbox

Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this

New and improved Linux Random Number Generator ready for testing

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

HTTP Desync Attacks: Request Smuggling Reborn