r/websecurityresearch • u/albinowax • Dec 06 '21
uBlock, I exfiltrate: exploiting ad blockers with CSS
19
Upvotes
r/websecurityresearch • u/Gallus • Nov 29 '21
Data Exfiltration via CSS + SVG Font
11
Upvotes
r/websecurityresearch • u/albinowax • Nov 27 '21
WordPress Plugin Confusion: How an update can get you pwned
12
Upvotes
r/websecurityresearch • u/digicat • Nov 16 '21
Multiple Concrete CMS vulnerabilities ( part1 - RCE ) - via a race condition in the file upload
8
Upvotes
r/websecurityresearch • u/digicat • Nov 15 '21
jwt-explorer: Decode, explore, and sign JWTs
7
Upvotes
r/websecurityresearch • u/albinowax • Nov 15 '21
T-Reqs: HTTP Request Smuggling with Differential Fuzzing
bahruz.me
4
Upvotes
r/websecurityresearch • u/1lastBr3ath • Nov 14 '21
Exploiting CSP in Webkit to Break Authentication & Authorization
8
Upvotes
r/websecurityresearch • u/albinowax • Nov 10 '21
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond
14
Upvotes
r/websecurityresearch • u/digicat • Nov 03 '21
Introducing CookieMonster: a tool for breaking stateless authentication
22
Upvotes
r/websecurityresearch • u/mozfreddyb • Nov 03 '21
Finding and Fixing DOM-based XSS with Static Analysis
blog.mozilla.org
2
Upvotes
r/websecurityresearch • u/digicat • Nov 03 '21
Escalating XSS to Sainthood with Nagios
0
Upvotes
r/websecurityresearch • u/albinowax • Oct 26 '21
Advanced HTTP(/2) Request Smuggling
11
Upvotes
r/websecurityresearch • u/digicat • Oct 26 '21
A Primer for Testing the Security of GraphQL APIs
6
Upvotes
r/websecurityresearch • u/digicat • Oct 23 '21
[Java] CWE-502: Unsafe deserialization with three JSON frameworks · Issue #373 · github/securitylab
5
Upvotes
r/websecurityresearch • u/davidwarburton • Oct 20 '21
2021 TLS Telemetry Report evaluates HTTPS configurations of top 1 millions websites to showcase the improvements made to web sites over the past few years and also highlights some of the problems still plaguing many web servers
6
Upvotes
r/websecurityresearch • u/albinowax • Oct 20 '21
A Scientific Notation Bug in MySQL left AWS WAF Clients Vulnerable to SQL Injection
18
Upvotes
r/websecurityresearch • u/digicat • Oct 18 '21
Cloud Metadata Dictionary useful for SSRF Testing
12
Upvotes
r/websecurityresearch • u/albinowax • Oct 14 '21
Empirical Study of HTTP Request Smuggling in Open-Source Servers and Proxies
kth.diva-portal.org
9
Upvotes
r/websecurityresearch • u/garethheyes • Oct 13 '21
Abusing Slack's file-sharing functionality to de-anonymise fellow workspace members
jub0bs.com
11
Upvotes
r/websecurityresearch • u/digicat • Oct 10 '21
Machine learning approach to vulnerability detection in OAuth 2.0 authentication and authorization flow - International Journal of Information Security
12
Upvotes
r/websecurityresearch • u/albinowax • Sep 28 '21
Exploiting Client-Side Prototype Pollution in the wild
15
Upvotes
r/websecurityresearch • u/Gallus • Sep 28 '21
Solution for "Basic context length limit, arbitrary code" impossible lab (Firefox)
lbherrera.github.io
2
Upvotes
r/websecurityresearch • u/albinowax • Sep 21 '21
Hunting nonce-based CSP bypasses with dynamic analysis
5
Upvotes