t3_1e3x972

Encoding Differentials: Why Charset Matters

t3_1e1ec5w

A Race to the Bottom - Database Transactions Undermining Your AppSec

t3_1dzsaol

Time-based ORM leak attacks

t3_1dxivgh

Universal Code Execution by Chaining Messages in Browser Extensions

t3_1du8oxa

Exploiting Client-Side Path Traversal to Perform CSRF [PDF]

t3_1do513h

ORM Leak vulnerabilities

t3_1dht51y

Iconv, set the charset to RCE (part 2): Remote code execution on Roundcube (CVE-2024-2961)

t3_1d1n5ml

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 1)

t3_1d03y6b

iframe and window.open magic

t3_1cx1s94

Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule

Arbitrary JavaScript execution in PDF.js

Exploit Archeology - Exploiting an old unknown Server Side Browser

I like the innovative expansion on RPO as a vuln class, but I'm not sure there is much impact here as an end result. Thoughts?

<div class="md"><p>I like the innovative expansion on RPO as a vuln class, but I&#39;m not sure there is much impact here as an end result. Thoughts?</p>
</div>

RPO -> RPFI

Great blog on CSPT by Mtnber

File-write on Gitlab via YAML parser differential

mXSS cheatsheet

here's my blog on Phishing Email Investigation: A Step-by-Step Analysis

Black Hat Asia 2024 Conference Slides

Vulnerable WordPress March 2024 (Kandovan)

BatBadBut: You can't securely execute commands on Windows

Bypassing DOMPurify with good old XML

Imperva SecureSphere WAF Bypass for POST Data Inspection Rules (CVE-2023-50969)

Making desync attacks easy with TRACE

Source Code Disclosure in ASP.NET via Cookieless Sessions

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

XSS in Joomla via invalid UTF-8

Top 10 web hacking techniques of 2023

Cross Window Forgery

ChatGPT Account Takeover via Wildcard Web Cache Deception

The HTTP Garden – A Parser Vulnerability Research Tool

A community for sharing and discussing novel web security research. 

Every post here is a potential nomination for our annual [Top 10 web hacking techniques](https://portswigger.net/research/top-10-web-hacking-techniques)

Friends with /r/slackers

[Join us on Discord](https://discord.gg/wnERJh8hhK)

# Submission guidelines:
* Submissions should directly relate to web security

* Submissions should contain something innovative or novel.

* Please review the [full submission guidelines](https://www.reddit.com/r/websecurityresearch/about/rules/)

Feel free to report any posts that violate the rules.

<div class="md"><p>A community for sharing and discussing novel web security research. </p>

<p>Every post here is a potential nomination for our annual <a href="https://portswigger.net/research/top-10-web-hacking-techniques">Top 10 web hacking techniques</a></p>

<p>Friends with <a href="/r/slackers">/r/slackers</a></p>

<p><a href="https://discord.gg/wnERJh8hhK">Join us on Discord</a></p>

<h1>Submission guidelines:</h1>

<ul>
<li><p>Submissions should directly relate to web security</p></li>
<li><p>Submissions should contain something innovative or novel.</p></li>
<li><p>Please review the <a href="https://www.reddit.com/r/websecurityresearch/about/rules/">full submission guidelines</a></p></li>
</ul>

<p>Feel free to report any posts that violate the rules.</p>
</div>

<div class="md"><p>A community for sharing and discussing novel web security research. </p>

<p>Join us on Discord: <a href="https://discord.gg/wnERJh8hhK">https://discord.gg/wnERJh8hhK</a></p>
</div>

Web Security Research

Submission guidelines:

8,351 Subscribers

Top 10 web hacking techniques of 2023