Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
First reported Aug 05, 2026 23:30 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordAbstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p
First reported Aug 06, 2025 22:20 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordWhen you open a HTTP request or response, what do you instinctively look for? Suspicious parameter names? CORS headers? Some clue as to the request's origin or underlying purpose? A single HTTP messag
First reported May 29, 2024 13:31 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordImagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview, the total price displayed is £399. After approval, the invoice is sent to the accounti
First reported Jul 09, 2024 12:51 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordUnicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo
First reported Jan 28, 2025 13:58 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordHave you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere
First reported Feb 20, 2025 13:20 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordHTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known
First reported Dec 04, 2024 15:03 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordIntroduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library
First reported Mar 18, 2025 14:55 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordI discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c
First reported Aug 26, 2025 12:54 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordThe strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP a
First reported Oct 29, 2024 13:59 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordIn this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie
First reported Jan 22, 2025 14:45 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordURL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection. These work by using ambiguous URLs to trigger URL
First reported Sep 03, 2024 14:52 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordSometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real
First reported Aug 19, 2025 14:30 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordBrowsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve
First reported Sep 03, 2025 14:46 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordThe power of our XSS cheat sheet is we get fantastic contributions from the web security community and this update is no exception. We had valuable contributions from Mozilla to remove events that no
First reported Jun 11, 2024 14:58 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordHave you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In this post, I'll briefly explore this phenomenon, the
First reported Oct 06, 2026 17:14 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordControl characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics
First reported Apr 30, 2025 12:37 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordHow many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for
First reported Sep 23, 2026 14:00 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordWebsites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets
First reported Aug 07, 2024 18:10 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordManual testing doesn't have to be repetitive. In this post, we're introducing Repeater Strike - a new AI-powered Burp Suite extension designed to automate the hunt for IDOR and similar vulnerabilities
First reported Jul 15, 2025 13:46 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 05, 2026 15:28 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordWe're delighted to announce three major research releases from PortSwigger Research will be published at both Black Hat USA and DEF CON 32. In this post, we'll offer a quick teaser of each talk, info
First reported Jul 02, 2024 12:57 UTCCatalog metadata updated Oct 14, 2026 11:57 UTCOpen evidence recordNote: This is a guest post by pentester Julen Garrido Estévez (@b3xal). Methodology Key results Examples Key learnings Prompt template A pentester's POV on Burp AI Pentester Julen Garrido Es
First reported Jan 16, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 11:54 UTCOpen evidence recordAI isn’t just reshaping cybersecurity - it’s challenging testers to rethink their entire playbook. In his latest article, “Hacking with Burp AI in the Chesspocalypse”, API expert Corey Ball draws less
First reported Nov 14, 2025 15:09 UTCCatalog metadata updated Oct 14, 2026 11:54 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.