PortSwigger Research at Black Hat USA and DEF CON
Watch the PortSwigger Research presentations from DEF CON.Gotta Cache 'em All: Bending the Rules of Web Cache
Exploitation
Splitting the Email Atom: Exploiting Parsers to Bypass
Access Controls
Read the white papers
Gotta Cache 'em All: Bending the Rules of Web Cache Exploitation
This paper will explore how different HTTP servers and proxies behave when parsing specially crafted URLs and explore ambiguities in the RFC that lead to path confusion.
Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls
In this paper, Gareth Heyes shows you how to turn email parsing discrepancies into access control bypasses and even RCE.
Listen to the Whispers: Web Timing Attacks that Actually Work
James Kettle unleashes novel attack concepts to coax out server secrets including masked misconfigurations, blind data-structure injection, hidden routes to forbidden areas, and a vast expanse of invisible attack surface.
