Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research describes client-side desync (CSD) attacks, in which malicious JavaScript on an arbitrary domain makes a victim's browser send a request with an attacker-controlled prefix in its body, leaving that prefix on the server's TCP/TLS socket...
PortSwigger Research published a lab demonstrating CL.0 request smuggling, in which a back-end server ignores the Content-Length header on requests to some endpoints. The lab walks through probing endpoints by sending paired requests over a single...
PortSwigger's lab demonstrates response queue poisoning through H2.TE request smuggling, exploiting a front-end server that downgrades HTTP/2 requests even when they carry an ambiguous length. The exercise walks through smuggling a prefix via chunked...
PortSwigger Research describes response queue poisoning, a request smuggling attack in which an attacker smuggles a complete request so the back-end returns two responses while the front-end expects one, leaving the extra response queued on the shared...
PortSwigger's lab demonstrates web cache poisoning through HTTP/2 request tunnelling, exploiting a front-end server that downgrades HTTP/2 requests and does not consistently sanitize incoming headers. The technique smuggles a request inside the :path...
PortSwigger's lab demonstrates request tunnelling against a front-end server that downgrades HTTP/2 requests and fails to sanitize incoming header names, allowing CRLF injection through a header name. Because the front-end does not reuse back-end...
PortSwigger Research describes HTTP request tunnelling, a technique that sends a single request eliciting two responses from the back-end, hiding a request and its response from the front-end even when connection reuse is restricted. The technique works...
PortSwigger's lab demonstrates HTTP/2 request splitting via CRLF injection, where a front-end server downgrades HTTP/2 requests and fails to adequately sanitize incoming headers, leaving it vulnerable to request smuggling. The exercise uses response queue...
PortSwigger's lab demonstrates HTTP/2 request smuggling against a front-end server that downgrades HTTP/2 requests and fails to sanitize incoming headers, letting an attacker inject CRLF sequences into a header value followed by a Transfer-Encoding:...
PortSwigger's lab demonstrates H2.CL request smuggling, in which a front-end server downgrades HTTP/2 requests even when they carry an ambiguous length, letting a smuggled prefix redirect the next request on the connection to an arbitrary host. The...
PortSwigger Research published a lab vulnerable to 0.CL request smuggling, a technique detailed in James Kettle's HTTP/1.1 Must Die whitepaper. The lab's simulated user Carlos visits the homepage every five seconds, and the exercise is to exploit the...
PortSwigger Research documents HTTP/2-exclusive injection vectors that are impossible to construct in HTTP/1 due to its text-based syntax, including smuggling extra headers through colon-and-CRLF combinations in header names and abusing the five...
PortSwigger Research explains that front-end servers supporting HTTP/2 commonly rewrite incoming requests into HTTP/1 syntax to talk to legacy back-end infrastructure, then reverse the process on responses, and that this downgrading is extremely widespread...
HTTP request smuggling is a technique for interfering with how a website processes sequences of HTTP requests from one or more users, and it was first documented in 2005 before being repopularized by PortSwigger's research. Most vulnerabilities arise...
PortSwigger's lab demonstrates a single-endpoint race condition in an email change feature, where the site stores only one pending email address at a time and overwrites it rather than appending. Sending parallel POST /my-account/change-email requests...
PortSwigger's lab demonstrates a partial construction race condition in a user registration mechanism, where a race window between creating a pending user and validating the confirmation token lets an attacker bypass email verification and register with an...
PortSwigger's lab describes a purchasing flow with a race condition that lets a user buy items at an unintended price, and asks the solver to buy a Lightweight L33t Leather Jacket using the account wiener:peter. The walkthrough identifies the cart...
PortSwigger's lab demonstrates a limit overrun race condition in a purchasing flow, where sending the POST /cart/coupon request 20 times in parallel applies a 20% discount code multiple times before the database records that it was already used. The lab...
PortSwigger's lab walks through a password reset mechanism whose token is built from a timestamp rather than a race condition, so sending two reset requests in parallel from separate sessions can produce identical tokens. By changing the username parameter...
PortSwigger's lab shows a login rate limit that blocks an account after more than three failed attempts, enforced per-username rather than per-session, with the failed-attempt count stored server-side. Because a race window exists between the attempt check...
PortSwigger Research describes race conditions as vulnerabilities where websites process requests concurrently without adequate safeguards, letting multiple threads collide on the same data during a brief "race window" that can be as short as milliseconds....
PortSwigger's lab runs on Node.js and Express and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object, letting an attacker pollute Object.prototype and inject arbitrary...
PortSwigger's lab runs on Node.js and the Express framework and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object. After logging in as wiener:peter and submitting the...
PortSwigger's lab runs on Node.js and the Express framework and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object, allowing Object.prototype to be polluted so that...
PortSwigger's lab runs on Node.js and Express and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object. The detection technique injects a __proto__ property with a status...
PortSwigger's lab runs on Node.js and the Express framework and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object. The walkthrough shows that injecting a json spaces...
PortSwigger Research explains that JavaScript uses prototypal inheritance, where every object is linked to a prototype and inherits its properties unless it defines its own with the same key. The article notes that objects inherit from all objects up the...
PortSwigger's lab demonstrates DOM XSS through client-side prototype pollution, where a query-string source lets an attacker add arbitrary properties to the global Object.prototype. The lab's searchLogger.js uses a config object's transport_url property to...
PortSwigger's lab demonstrates DOM XSS through client-side prototype pollution: an alternative pollution vector in the query string adds a foo property to Object.prototype, and a gadget in searchLoggerAlternative.js passes the manager.sequence property to...
PortSwigger's lab demonstrates DOM XSS via client-side prototype pollution: the site's deparamSanitized.js uses a sanitizeKey() blocklist from searchLoggerFiltered.js to strip dangerous property keys, but the filter is not applied recursively, so a blocked...