This is the second post in a two-part series on DNS rebinding. In this post, I introduce new techniques for achieving reliable, split-second DNS rebinding in Chrome, Edge, and Safari when IPv6 is available, as well as a technique for bypassing the local network…

Those are the most useful payloads to prove the vast majority of Cross Site Scripting (XSS) vulnerabilities out there.

Catch the recording of our recent webinar featuring James Kettle, Director of Research at PortSwigger! In this session, we dive into advanced web research techniques using Burp Suite, including how to discover ideas and targets, optimize your setup, and utilize…

Refine your recon methods or learn totally new ones! Follow top hacker, OrwaGodfather as he introduces you to new and precise tactics that you may have never tried.

Sign-up for your Bugcrowd account to follow along: https://bugcrowd.com/user/sign_up

Follow…

Explore the resilience of the new Hugging Chat Assistance to Sleepy Agent and Image Markdown Rendering vulnerabilities.

📌 [ 繁體中文 | English ] Hey there! This is my research on Apache HTTP Server presented at Black Hat USA 2024. Additionally, this research will also be presented at HITCON and OrangeCon. If you’re int

Web application Vulnerability Writeup

An introduction to CSPT, including some advances WAF bypass and exploitation techniques.

dangerouslySetInnerHTML is dangerous, and using it carelessly will create XSS vulnerabilities in your application. In this article, we discuss why the property is there, how you can use it, and how the Signal messenger misused it.

On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless…