Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Update: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentati
First reported Jan 06, 2026 15:31 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordThrough the years, we have seen many attacks exploiting web caches to hijack sensitive information or store malicious payloads. However, as CDNs became more popular, new discrepancies between propriet
First reported Aug 08, 2024 22:27 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordMany testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi
First reported Sep 17, 2025 12:40 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordSigned web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond t
First reported May 22, 2024 12:37 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 19, 2024 14:31 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordIn this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re
First reported Mar 05, 2024 14:55 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordAbstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi
First reported Aug 05, 2026 19:30 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordHTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length,
First reported Nov 11, 2025 14:41 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordGareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
First reported Aug 06, 2026 22:00 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordTLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi
First reported Dec 10, 2025 12:32 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordTired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a
First reported Apr 23, 2025 13:17 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 04, 2025 15:01 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordAbstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
First reported Aug 05, 2026 23:30 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordAbstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p
First reported Aug 06, 2025 22:20 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordWhen you open a HTTP request or response, what do you instinctively look for? Suspicious parameter names? CORS headers? Some clue as to the request's origin or underlying purpose? A single HTTP messag
First reported May 29, 2024 13:31 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordImagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview, the total price displayed is £399. After approval, the invoice is sent to the accounti
First reported Jul 09, 2024 12:51 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordUnicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo
First reported Jan 28, 2025 13:58 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordHave you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere
First reported Feb 20, 2025 13:20 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordHTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known
First reported Dec 04, 2024 15:03 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordIntroduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library
First reported Mar 18, 2025 14:55 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordI discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c
First reported Aug 26, 2025 12:54 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordThe strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP a
First reported Oct 29, 2024 13:59 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordIn this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie
First reported Jan 22, 2025 14:45 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordURL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection. These work by using ambiguous URLs to trigger URL
First reported Sep 03, 2024 14:52 UTCCatalog metadata updated Oct 16, 2026 02:30 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.