Backslash Powered Scanning: hunting unknown vulnerability classes
Summary: PortSwigger researcher James Kettle presented an approach called Backslash Powered Scanning that replaces canned, technology-specific payloads with generic probes designed to detect interesting input transformations, then investigates the small fraction of inputs that behave unusually. He argues existing scanners miss server-side injection classes like SSTI because they rely on hardcoded payloads for each engine, and notes the technique could have found SSTI before the class was publicly discovered.
Key Takeaway: The paper's own example is a client whose site was flagged as a false-positive XSS by Burp Suite, where manual review found a more serious SSTI vulnerability - a reminder that scanner output can point at the wrong bug while the real one sits unaddressed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026