Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c
First reported Aug 26, 2025 12:54 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHave you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In this post, I'll briefly explore this phenomenon, the
First reported Oct 06, 2026 17:14 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordI'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in
First reported Oct 05, 2026 15:04 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP a
First reported Oct 29, 2024 13:59 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAbstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi
First reported Aug 05, 2026 19:30 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordSigned web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond t
First reported May 22, 2024 12:37 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAbstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p
First reported Aug 06, 2025 22:20 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 05, 2026 15:28 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known
First reported Dec 04, 2024 15:03 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length,
First reported Nov 11, 2025 14:41 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIntroduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library
First reported Mar 18, 2025 14:55 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAbstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
First reported Aug 05, 2026 23:30 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWe're delighted to announce three major research releases from PortSwigger Research will be published at both Black Hat USA and DEF CON 32. In this post, we'll offer a quick teaser of each talk, info
First reported Jul 02, 2024 12:57 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordTLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi
First reported Dec 10, 2025 12:32 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThrough the years, we have seen many attacks exploiting web caches to hijack sensitive information or store malicious payloads. However, as CDNs became more popular, new discrepancies between propriet
First reported Aug 08, 2024 22:27 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordSome websites parse email addresses to extract the domain and infer which organisation the owner belongs to. This pattern makes email-address parser discrepancies critical. Predicting which domain an
First reported Aug 07, 2024 21:32 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.