Hunting asynchronous vulnerabilities
Summary: PortSwigger researcher James Kettle described techniques for finding asynchronous vulnerabilities that produce no visible output, using exploit-induced callbacks in which a payload makes the target application connect back to an attacker-controlled listener. The writeup, drawn from his 44Con and BSides Manchester talks, covers callback payloads for XML, SQL across PostgreSQL, MySQL, SQLite3, SQL Server and Oracle, shell command injection, and XSS, and states that Burp Suite already uses the XML, shell command injection and best SQL techniques, with blind XSS checks coming.
What's compelling: Vulnerabilities like blind second-order SQL injection and command injection through nightly cronjobs or asynchronous logging can survive repeated pentests and reach production unfixed, because there is no output to observe - only an out-of-band callback reveals them.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026