Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger describes stored open redirection as occurring when user-controllable input submitted in an earlier request is stored by the application and later incorporated into a redirection target, letting an attacker build a URL on the application's own...
Open redirection vulnerabilities arise when an application incorporates user-controllable data into a redirection target in an unsafe way, letting an attacker construct a URL within the application that redirects to an arbitrary external domain....
PortSwigger Research notes that third-party JavaScript libraries can introduce DOM-based vulnerabilities, including ones used to hijack user accounts such as DOM-XSS. Because some library flaws affect every application that imports the library while others...
PortSwigger Research describes HTTP headers that can override parts of a request URL, affecting how requests are routed and processed while intermediate systems remain unaware of them. The write-up states this can bypass reverse proxy and web application...
PortSwigger Research describes stored suspicious input transformation, which occurs when an application receives user input, transforms it through decoding such as UTF-8 or URL-encoding or through escape sequences such as backslash escaping, and then...
PortSwigger describes suspicious input transformation as occurring when an application receives user input, transforms it - such as decoding UTF-8 or URL-encoding, or processing backslash escape sequences - and then performs further processing on the...
PortSwigger Research describes reflected input as data copied from a request and echoed into the application's immediate response, noting that this is not a vulnerability in its own right. The text states that reflected input is a prerequisite for...
PortSwigger Research describes retrieval of stored input as a case where user input is stored and later embedded into the application's responses, which is not a vulnerability in its own right but is a prerequisite for cross-site scripting, open...
PortSwigger Research describes a scanner finding in which a response contains two or more Set-Cookie headers that set the same cookie to different values. Browsers accept only one of these values, typically the one in the last header, and the duplicate...
PortSwigger Research describes applications that submit a serialized object in a request parameter, which can expose the application to code execution vulnerabilities through its use of serialized objects. The text notes that exploiting such code execution...
PortSwigger Research describes a scanner finding where an application returned a redirection response containing a long message body that browsers normally hide because they follow the redirect automatically. The concern is that such redirection responses...
XML entity expansion vulnerabilities arise because the XML specification lets documents define entities that reference other entities within the same document, and when this is done recursively to significant depth the parser consumes exponentially...
ASP.NET's ViewState mechanism serializes interface and other data into a hidden form field that the server signs by default to prevent tampering, but setting Page.EnableViewStateMac to false disables that signing. With signing off, an attacker can modify...
PortSwigger Research describes applications that use POST requests to transfer sensitive information from one domain to another, noting this does not necessarily constitute a security vulnerability but does create a trust relationship between the two...
PortSwigger Research describes an HTTP request parameter containing SQL syntax that, if incorporated into a SQL query and executed by the server, makes the application almost certainly vulnerable to SQL injection. The guidance states applications should...
PortSwigger Research describes an application that responds to login submissions with a link containing the user's password in the URL query string. Sensitive information in URLs can be logged in the browser, the web server, and any forward or reverse...
PortSwigger Research describes applications that submit passwords using the GET method, which places them in the query string of the requested URL. Those URLs may be logged in the user's browser, the web server, and any forward or reverse proxy between the...
PortSwigger Research describes a vulnerability class in which applications return passwords submitted by users in clear form in later responses. The write-up notes that weaknesses in session handling, broken access controls, and cross-site scripting could...
PortSwigger Research notes that application responses may depend systematically on the User-Agent header, a behavior that is not itself a vulnerability but can expose additional attack surface. The text says mobile interfaces are often less thoroughly...
PortSwigger Research describes a spoofable client IP address issue: when an application trusts HTTP request headers such as X-Forwarded-For, True-Client-IP, or X-Real-IP to specify the connecting client's remote IP address, malicious clients can spoof...
PortSwigger Research describes a scanner finding where application responses depend systematically on whether the Referer header is present in requests, noting this behavior does not necessarily constitute a security vulnerability. The text states the...
PortSwigger describes external service interaction as the ability to induce an application to contact an arbitrary external service, such as a web or mail server, and notes this is not a vulnerability in itself and may be intended behavior. The concern is...
PortSwigger describes external service interaction as the ability to induce an application to contact an arbitrary external service, such as a web or mail server, which is not a vulnerability in itself and may be intended behavior. The concern is that an...
PortSwigger Research notes that inducing an application to interact with an arbitrary external service, such as a web or mail server, is not a vulnerability in itself and may even be intended behavior, though it can sometimes indicate a vulnerability with...
PortSwigger describes a vulnerability where applications transmit passwords over unencrypted connections, allowing an attacker positioned to eavesdrop on the victim's network traffic to intercept them. The exposure typically occurs over insecure...
PortSwigger Research describes a JWT vulnerability in which a server implicitly trusts the optional "x5u" header, a URL pointing to the X.509 public key certificate or chain used to verify the token's signature. An attacker can point "x5u" at an external...
The JSON Web Signature specification defines an optional "jku" header containing a URL to a set of keys used to sign the JWT, and PortSwigger Research describes how an application that implicitly trusts this header may verify signatures using an arbitrary...
Burp Suite's scanner attempts to brute-force the HMAC secret behind every JWT it observes in traffic, working offline against a list of common weak secrets without sending requests to the server. When the secret can be cracked this way, an attacker can...
PortSwigger Research describes a JWT flaw in which a server implicitly trusts the optional "jwk" header, which carries key information for signature verification, and so verifies tokens using an attacker-supplied public key. An attacker can insert or...
PortSwigger Research describes a JWT vulnerability in which a server accepts tokens using the "none" algorithm, meaning it may accept tokens with no signature at all. Because the JWT header can be tampered with client-side, an attacker can set "alg" to...