Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Update: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentati
First reported Jan 06, 2026 15:31 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordLast year Johan Carlsson discovered you could conceal payloads inside the credentials part of the URL . This was fascinating to me especially because the payload is not actually visible in the URL in
First reported Oct 23, 2024 12:59 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordBrowsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve
First reported Sep 03, 2025 14:46 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordControl characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics
First reported Apr 30, 2025 12:37 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHave you ever found an HTTP desync vulnerability that seemed impossible to exploit due to its complicated constraints? In this blogpost we will explore a new exploitation technique that can be used to
First reported Mar 19, 2024 14:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWebsites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets
First reported Aug 07, 2024 18:10 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordURL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection. These work by using ambiguous URLs to trigger URL
First reported Sep 03, 2024 14:52 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordMany testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi
First reported Sep 17, 2025 12:40 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordI was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t
First reported Aug 25, 2026 14:24 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordGareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
First reported Aug 06, 2026 22:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordImagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview, the total price displayed is £399. After approval, the invoice is sent to the accounti
First reported Jul 09, 2024 12:51 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordManual testing doesn't have to be repetitive. In this post, we're introducing Repeater Strike - a new AI-powered Burp Suite extension designed to automate the hunt for IDOR and similar vulnerabilities
First reported Jul 15, 2025 13:46 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re
First reported Mar 05, 2024 14:55 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe power of our XSS cheat sheet is we get fantastic contributions from the web security community and this update is no exception. We had valuable contributions from Mozilla to remove events that no
First reported Jun 11, 2024 14:58 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 19, 2024 14:31 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 04, 2025 15:01 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie
First reported Jan 22, 2025 14:45 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHave you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere
First reported Feb 20, 2025 13:20 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordSometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real
First reported Aug 19, 2025 14:30 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWhen you open a HTTP request or response, what do you instinctively look for? Suspicious parameter names? CORS headers? Some clue as to the request's origin or underlying purpose? A single HTTP messag
First reported May 29, 2024 13:31 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordUnicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo
First reported Jan 28, 2025 13:58 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordNominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, an
First reported Jan 08, 2025 14:07 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHow many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for
First reported Sep 23, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordTired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a
First reported Apr 23, 2025 13:17 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.