t3_1bt622w

Bypassing DOMPurify with good old XML

t3_1btsmda

t3_1bpzifx

Imperva SecureSphere WAF Bypass for POST Data Inspection Rules (CVE-2023-50969)

t3_1bilszn

Making desync attacks easy with TRACE

t3_1b8w2d0

Source Code Disclosure in ASP.NET via Cookieless Sessions

t3_1b1e0qw

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

t3_1b0clet

XSS in Joomla via invalid UTF-8

t3_1ausjf7

Top 10 web hacking techniques of 2023

t3_1auiuy9

Cross Window Forgery

t3_1aov8c8

ChatGPT Account Takeover via Wildcard Web Cache Deception

t3_1ajrb11

The HTTP Garden – A Parser Vulnerability Research Tool

ModSecurity: Path Confusion and really easy bypass on v2 and v3

Find HTTP Downgrade attacks with SmuggleFuzz

Top 10 web hacking techniques of 2023 - nominations open

PNLS: Tool capable of capturing SSIDs from device's Preferred Network List

Extension provides automatic detection and in-line editing of token within HTTP requests/responses and WebSocket messages, signing of tokens and automation of brute force attacks against signed tokens implementations. It was inspired by Fraser Winterborn and Dolph Flynn JWT Token extension. If you want to know more about what happened under the hood, check the blog [post](https://btlfry.gitlab.io/notes/posts/sessionless/)

<div class="md"><p>Extension provides automatic detection and in-line editing of token within HTTP requests/responses and WebSocket messages, signing of tokens and automation of brute force attacks against signed tokens implementations. It was inspired by Fraser Winterborn and Dolph Flynn JWT Token extension. If you want to know more about what happened under the hood, check the blog <a href="https://btlfry.gitlab.io/notes/posts/sessionless/">post</a></p>
</div>

Sessionless: Burp Suite extension for editing, signing, verifying and attacking signed tokens

Introducing SMTP Smuggling: A novel technique for spoofing e-mails

Pentesting APIs using gRPC-Web and methodology for doing it.

<div class="md"><p>Pentesting APIs using gRPC-Web and methodology for doing it.</p>
</div>

Hacking into gRPC Web

wrapwrap: using PHP filters to wrap a file with a prefix and suffix

Split-Second DNS Rebinding in Chrome, Edge and Safari

Blind CSS Exfiltration: exfiltrate unknown web pages

USENIX Security '23 - RøB: Ransomware over Modern Web Browsers

Ransomware over Modern Web Browsers

Unicode XSS via Combining Characters

Cookie Bugs - Smuggling & Injection

TRAP; RESET; POISON; - Taking over a country Kaminsky style

CLZero - Request smuggler fuzzing tool for CL.0

Critical Variable Mass Assignment Vulnerability in Adobe ColdFusion (CVE-2023-44350)

CL.0 request smuggling on Akamai/F5 with NTLM theft

DOM-based race condition: racing in the browser for fun

Pytest for Pentesters: Test with the tools Developers use

Compromising F5 BIGIP with AJP Request Smuggling

A community for sharing and discussing novel web security research. 

Every post here is a potential nomination for our annual [Top 10 web hacking techniques](https://portswigger.net/research/top-10-web-hacking-techniques)

Friends with /r/slackers

[Join us on Discord](https://discord.gg/wnERJh8hhK)

# Submission guidelines:
* Submissions should directly relate to web security

* Submissions should contain something innovative or novel.

* Please review the [full submission guidelines](https://www.reddit.com/r/websecurityresearch/about/rules/)

Feel free to report any posts that violate the rules.

<div class="md"><p>A community for sharing and discussing novel web security research. </p>

<p>Every post here is a potential nomination for our annual <a href="https://portswigger.net/research/top-10-web-hacking-techniques">Top 10 web hacking techniques</a></p>

<p>Friends with <a href="/r/slackers">/r/slackers</a></p>

<p><a href="https://discord.gg/wnERJh8hhK">Join us on Discord</a></p>

<h1>Submission guidelines:</h1>

<ul>
<li><p>Submissions should directly relate to web security</p></li>
<li><p>Submissions should contain something innovative or novel.</p></li>
<li><p>Please review the <a href="https://www.reddit.com/r/websecurityresearch/about/rules/">full submission guidelines</a></p></li>
</ul>

<p>Feel free to report any posts that violate the rules.</p>
</div>

<div class="md"><p>A community for sharing and discussing novel web security research. </p>

<p>Join us on Discord: <a href="https://discord.gg/wnERJh8hhK">https://discord.gg/wnERJh8hhK</a></p>
</div>

Web Security Research

Submission guidelines:

7,885 Subscribers

Top 10 web hacking techniques of 2023

Ransomware over Modern Web Browsers