# PortSwigger Research Pioneering web security research and the latest research articles from the industry-leading team at PortSwigger Research, James Kettle and Gareth Heyes. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## What's in a tag name? JavaScript, apparently DevFeed: [What's in a tag name? JavaScript, apparently]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2026-08-25T14:24:32Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [JavaScript](), [browser](), [HTML](), [Developer Tools](), [Web Development]() Tags: [browser](), [eval](), [event](), [html](), [javascript](), [payload](), [vector]() ### AI overview The article explores unusual HTML tag-name and attribute behaviors that can be combined with JavaScript features to create XSS vectors and potentially bypass web application firewalls. It discusses case transformations, event handlers, the Function constructor, eval, focusability, and alternative HTML attributes across browsers. ### Source excerpt I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t ## CSS:the bomb inside your inbox DevFeed: [CSS:the bomb inside your inbox]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2026-08-06T22:00:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [modern web development](), [Web Development](), [passwords]() Tags: [atlas](), [browser](), [bug](), [css](), [firefox](), [html](), [passwords](), [ui]() ### AI overview A security paper on abusing discrepancies between CSS/HTML sanitizers and browser rendering in webmail clients. It describes techniques that can cross trust boundaries, spoof UI actions, exfiltrate tokens, and steal passwords, including an Outlook UI-control issue involving HTML labels. ### Source excerpt Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this ## CRLF-Powered Desync Attacks: Beheading HTTP Streams DevFeed: [CRLF-Powered Desync Attacks: Beheading HTTP Streams]() Original publisher: [Read original article]() Author: Tom Stacey Published: 2026-08-05T23:30:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities](), [web applications]() Tags: [attacks](), [browser](), [http](), [research](), [streams](), [vulnerabilities]() ### AI overview A security research paper on turning HTTP header injection into request-smuggling desynchronization attacks, including CRLF-powered desync worms and browser-assisted exploitation techniques. ### Source excerpt Abstract In this paper we'll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power ## Can AI do novel security research? Meet the HTTP Terminator DevFeed: [Can AI do novel security research? Meet the HTTP Terminator]() Original publisher: [Read original article]() Author: James Kettle Published: 2026-08-05T19:30:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [AI research agents](), [web applications]() Tags: [ai](), [automation](), [autonomous](), [exploits](), [generative-ai](), [http](), [research](), [security]() ### AI overview The article examines whether autonomous AI systems can discover novel web-security attack techniques. It presents the HTTP Terminator, describes HTTP desynchronization research and exploits, and explores the limits of fully autonomous versus human/AI research loops. ### Source excerpt Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi ## Top 10 web hacking techniques of 2025 DevFeed: [Top 10 web hacking techniques of 2025]() Original publisher: [Read original article]() Author: James Kettle Published: 2026-02-05T15:28:08Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Security](), [Web](), [vulnerability](), [Parser](), [Protocol (disambiguation)](), [Chrome](), [Caching](), [Tooling]() Tags: [cache](), [chrome](), [community](), [http](), [research](), [security](), [techniques](), [vulnerability](), [web]() ### AI overview This annual, community-powered selection highlights ten innovative web-hacking techniques from 2025. The supplied excerpts discuss parser differentials, HTTP/2 CONNECT research and tooling, Chrome connection-pool prioritisation used to leak cross-origin redirect hostnames, and internal web cache poisoning. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year ## Top 10 web hacking techniques of 2025: call for nominations DevFeed: [Top 10 web hacking techniques of 2025: call for nominations]() Original publisher: [Read original article]() Author: James Kettle Published: 2026-01-06T15:31:28Z Content type: news Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities]() Tags: [community](), [research](), [security](), [techniques](), [vulnerabilities](), [web]() ### AI overview A call for community nominations for the most valuable reusable web-hacking research techniques from 2025. Nominations are closed and community voting is live. ### Source excerpt Update: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentati ## The Fragile Lock: Novel Bypasses For SAML Authentication DevFeed: [The Fragile Lock: Novel Bypasses For SAML Authentication]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-12-10T12:32:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities]() Tags: [attacks](), [authentication](), [open-source](), [php](), [ruby](), [security](), [vulnerabilities]() ### AI overview The article describes novel XML Signature Wrapping attacks that exploit parser inconsistencies to bypass SAML authentication in Ruby and PHP ecosystems. ### Source excerpt TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi ## Introducing HTTP Anomaly Rank DevFeed: [Introducing HTTP Anomaly Rank]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-11-11T14:41:53Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities](), [SDKs]() Tags: [api](), [http](), [responses](), [sorting](), [tools](), [vulnerabilities]() ### AI overview HTTP Anomaly Rank is an algorithm integrated into Turbo Intruder and Burp Suite's API to rank anomalous HTTP responses. It weights stable response attributes and scores unusual values to surface subtle discrepancies in noisy result sets. ### Source excerpt HTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length, ## WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine DevFeed: [WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-09-17T12:40:06Z Content type: tutorial Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities](), [web applications]() Tags: [extension](), [fuzzing](), [json](), [python](), [testing](), [vulnerabilities]() ### AI overview The article introduces WebSocket Turbo Intruder, a Burp Suite extension for high-volume fuzzing of WebSocket messages with custom Python code. It explains WebSocket-testing challenges, installation, built-in tools, and a basic message-testing example. ### Source excerpt Many testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi ## Cookie Chaos: How to bypass \_\_Host and \_\_Secure cookie prefixes DevFeed: [Cookie Chaos: How to bypass \_\_Host and \_\_Secure cookie prefixes]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-09-03T14:46:23Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [browsers](), [Security](), [browser](), [ASP.NET](), [Django]() Tags: [attacks](), [browser](), [browsers](), [django](), [frameworks](), [security]() ### AI overview This article explains how discrepancies between browser and server-side cookie parsing can bypass the security restrictions of the __Host and __Secure cookie prefixes. It describes UTF-8 and Unicode whitespace techniques, including behavior in Django and ASP.NET, and notes differences in Safari's handling of cookie names. ### Source excerpt Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you'll see how to bypass cookie defenses using discrepancies in browser and serve ## Inline Style Exfiltration: leaking data with chained CSS conditionals DevFeed: [Inline Style Exfiltration: leaking data with chained CSS conditionals]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-08-26T12:54:03Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [CSS](), [browsers](), [Chromium](), [selectors]() Tags: [browsers](), [chromium](), [code](), [css]() ### AI overview The article presents a CSS injection technique that exfiltrates attribute data through inline styles, without selectors or stylesheet imports. It uses CSS conditionals, nested comparisons, and background requests to test possible values, with Burp Suite Custom Actions helping brute-force non-complex data such as user IDs and usernames. The technique reportedly works only in Chromium-based browsers at the time of writing. ### Source excerpt I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c ## Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling DevFeed: [Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-08-19T14:30:44Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [HTTP](), [vulnerability]() Tags: [2025](), [false-positive](), [how-to](), [http](), [tcp](), [tls](), [vulnerability]() ### AI overview This article explains how to distinguish HTTP pipelining, keep-alive, and connection reuse from genuine HTTP request smuggling vulnerabilities. It recommends disabling connection reuse when testing and introduces Burp Suite tools that help analyze low-level HTTP behavior. ### Source excerpt Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real ## HTTP/1.1 must die: the desync endgame DevFeed: [HTTP/1.1 must die: the desync endgame]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-08-06T22:20:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [HTTP](), [Security](), [Vulnerabilities](), [Parser](), [Open Source]() Tags: [2025](), [akamai](), [cloudflare](), [http](), [issue](), [netlify](), [open-source](), [paper](), [protocol](), [security](), [tcp](), [tls](), [vulnerabilities](), [web]() ### AI overview This paper argues that HTTP/1.1 has a fundamental request-boundary flaw that enables HTTP desync and request smuggling attacks. It presents attack techniques, case studies involving Akamai, Cloudflare, and Netlify, an open-source detection toolkit, and the case for replacing HTTP/1.1 with HTTP/2 or later. ### Source excerpt Abstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p ## Repeater Strike: manual testing, amplified DevFeed: [Repeater Strike: manual testing, amplified]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-07-15T13:46:37Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Testing](), [Vulnerabilities](), [Artificial Intelligence](), [Extension](), [Regular expression](), [JSON](), [API keys](), [Java]() Tags: [ai](), [ai-models](), [extension](), [json](), [parameter](), [re](), [security](), [testing](), [vulnerabilities]() ### AI overview This article introduces Repeater Strike, an AI-powered Burp Suite extension that automates vulnerability hunting from Repeater traffic. It analyzes requests and responses, generates regular expressions, scans proxy history for related IDOR and similar vulnerabilities, and validates findings before creating reusable Strike Rules. ### Source excerpt Manual testing doesn't have to be repetitive. In this post, we're introducing Repeater Strike - a new AI-powered Burp Suite extension designed to automate the hunt for IDOR and similar vulnerabilities ## Drag and Pwnd: Leverage ASCII characters to exploit VS Code DevFeed: [Drag and Pwnd: Leverage ASCII characters to exploit VS Code]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-04-30T12:37:11Z Content type: tutorial Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities]() Tags: [ascii](), [bash](), [javascript](), [vs-code](), [vulnerabilities]() ### AI overview The article explains how ASCII control characters can be abused through VS Code terminal handling to cause command injection behavior. ### Source excerpt Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics ## Document My Pentest: you hack, the AI writes it up! DevFeed: [Document My Pentest: you hack, the AI writes it up!]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-04-23T13:17:24Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Artificial Intelligence](), [Extension](), [audit trail](), [Security](), [Testing](), [Web](), [Open Source](), [Regular expression]() Tags: [ai](), [audit-trail](), [extension](), [open-source](), [security](), [testing](), [vulnerabilities](), [web](), [xss]() ### AI overview The article introduces Document My Pentest, an open-source Burp Suite extension that uses Burp AI features to observe web-security testing activity in real time and build a structured audit trail. It describes generating reports with AI and explains prototype lessons, including difficulties analyzing complete requests and responses, successful detection of clear Path Traversal evidence, and a regex-based approach for identifying reflected input. The approach worked for some reflected-data cases but was not suitable for attacks such as Request Smuggling. ### Source excerpt Tired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a ## SAML roulette: the hacker always wins DevFeed: [SAML roulette: the hacker always wins]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-03-18T14:55:43Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [GitLab](), [Vulnerabilities](), [Security](), [XML](), [Exploit](), [Authentication](), [Authorization](), [Ruby](), [Library]() Tags: [attacks](), [authentication](), [authorization](), [exploit](), [github](), [gitlab](), [library](), [research](), [ruby](), [saml](), [security](), [testing](), [vulnerabilities](), [vulnerability](), [xml]() ### AI overview This security research post explains how round-trip attacks and namespace confusion in the ruby-saml library can be chained to bypass signature verification and obtain unauthenticated administrative access to GitLab Enterprise. It describes parser inconsistencies involving REXML and Nokogiri, XML mutations using comments and CDATA, and a testbed for evaluating SAML libraries. The supplied article text ends during the discussion of DOCTYPE analysis. ### Source excerpt Introduction In this post, we'll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library ## Shadow Repeater:AI-enhanced manual testing DevFeed: [Shadow Repeater:AI-enhanced manual testing]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-02-20T13:20:19Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Artificial Intelligence](), [Testing](), [Vulnerabilities](), [Extension](), [Code]() Tags: [ai](), [attacks](), [automatic](), [code](), [extension](), [github](), [request](), [testing](), [vulnerabilities](), [xss]() ### AI overview Shadow Repeater is a Burp Repeater extension that enhances manual security testing with AI-powered automatic variation testing. It analyzes changed parameters and payloads, generates variants through an AI model, tests them against the target, and uses response diffing to identify potentially interesting behavior and vulnerabilities. ### Source excerpt Have you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere ## Top 10 web hacking techniques of 2024 DevFeed: [Top 10 web hacking techniques of 2024]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-02-04T15:01:48Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Hacking](), [Application Security](), [Security](), [web applications](), [OAuth](), [Cache](), [account takeover](), [LocalStorage](), [JavaScript]() Tags: [2025](), [account-takeover](), [cache](), [chatgpt](), [cookies](), [hacking](), [oauth](), [research](), [security](), [techniques](), [web](), [xss]() ### AI overview This annual community-powered review identifies notable web security research and hacking techniques from 2024. The supplied excerpts discuss OAuth flow hijacking through Cookie Tossing, risks involving cookies and JavaScript's Same-Origin Policy, and a ChatGPT account takeover using inconsistent decoding, path traversal, and Web Cache Deception. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year ## Bypassing character blocklists with unicode overflows DevFeed: [Bypassing character blocklists with unicode overflows]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-01-28T13:58:28Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [ASCII](), [JavaScript](), [Bug Bounty]() Tags: [2025](), [ascii](), [attacks](), [bug-bounty](), [javascript](), [published]() ### AI overview The article explains how Unicode codepoint truncation, or Unicode overflow, can bypass character blocklists by producing specific ASCII characters when values exceed byte or JavaScript codepoint limits. It describes active use of these truncation attacks by bug bounty hunters and related tooling added to ActiveScan++, Hackvertor, and Shazzer. ### Source excerpt Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo ## Stealing HttpOnly cookies with the cookie sandwich technique DevFeed: [Stealing HttpOnly cookies with the cookie sandwich technique]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-01-22T14:45:11Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [vulnerability](), [Exploit](), [Chrome](), [Cross-origin resource sharing (CORS)](), [browser](), [Web]() Tags: [browser](), [chrome](), [cors](), [vulnerability](), [web](), [xss]() ### AI overview This security research describes the "cookie sandwich" technique, which abuses legacy cookie parsing, quoted values, and browser behavior to bypass the HttpOnly flag on certain servers. By manipulating cookie structure, reflected parameters, analytics identifiers, CORS requests with credentials, or same-origin XSS, an attacker may expose sensitive HttpOnly cookie values to client-side scripts. ### Source excerpt In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie ## Top 10 web hacking techniques of 2024: nominations open DevFeed: [Top 10 web hacking techniques of 2024: nominations open]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-01-08T14:07:27Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Web](), [Security](), [Vulnerabilities]() Tags: [2025](), [blog](), [hacking](), [posts](), [security](), [techniques](), [web]() ### AI overview PortSwigger has opened nominations for the top 10 new web hacking techniques of 2024. The annual community process seeks innovative, practical, and reusable web security research, with community nominations and voting followed by a panel vote and publication of the finalists. ### Source excerpt Nominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, an ## Bypassing WAFs with the phantom $Version cookie DevFeed: [Bypassing WAFs with the phantom $Version cookie]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2024-12-04T15:03:35Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Parsing](), [HTTP](), [Vulnerabilities](), [Cross-origin resource sharing (CORS)](), [Spring Boot](), [Python](), [Flask](), [Django]() Tags: [cookies](), [django](), [flask](), [http](), [parsing](), [python](), [security](), [spring-boot](), [vulnerabilities]() ### AI overview This article explains how differences between HTTP cookie parsers can be exploited to bypass web application firewalls. It examines legacy cookie features such as the phantom $Version attribute, quoted values, and octal escape sequences, with examples from Spring Boot, Apache Tomcat, and Python frameworks including Flask and Django. ### Source excerpt HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known ## URL Validation Bypass Cheat Sheet Adds IP Address Formats and a New Userinfo Parsing Payload DevFeed: [URL Validation Bypass Cheat Sheet Adds IP Address Formats and a New Userinfo Parsing Payload]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2024-10-29T13:59:13Z Content type: release Language: en Sources: [PortSwigger Research]() Topics: [Security](), [Exploit](), [Vulnerabilities](), [Web](), [browsers](), [Chrome](), [Firefox](), [Cross-origin resource sharing (CORS)]() Tags: [chrome](), [exploit](), [firefox](), [parsing](), [security](), [vulnerabilities](), [web]() ### AI overview This update to the URL Validation Bypass Cheat Sheet adds new IPv4 representations, IPv6 support, configurable character encodings, and a payload targeting differences in userinfo parsing. The article says the payload may expose vulnerabilities such as open redirects or SSRF and describes reproducing a separate patched exploit. ### Source excerpt The strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today's update is no exception. We are excited to introduce a new and improved IP a [Next page]()