Buy a Burp Suite Certified Practitioner exam, pass before 15 Dec, and we'll refund your $99.  –   Find out more
Research Academy Daily Swig
My account Customers About Blog Careers Legal Contact Resellers
Research hero

PortSwigger Research

Pushing the boundaries of web security

Featured Research

HTTP/2: The Sequel is Always Worse

05 August 2021 HTTP/2: The Sequel is Always Worse

Finding DOM Polyglot XSS in PayPal the Easy Way

30 June 2021 Finding DOM Polyglot XSS in PayPal the Easy Way

Portable Data exFiltration: XSS for PDFs

10 December 2020 Portable Data exFiltration: XSS for PDFs

Evading defences using VueJS script gadgets

12 October 2020 Evading defences using VueJS script gadgets

Latest Research Articles

Creating a 3D world in pure CSS

13 October 2021 Creating a 3D world in pure CSS

Hunting nonce-based CSP bypasses with dynamic analysis

The first victim, our own website 17 September 2021 Hunting nonce-based CSP bypasses with dynamic analysis The first victim, our own website

HTTP/2: The Sequel is Always Worse

05 August 2021 HTTP/2: The Sequel is Always Worse

alert() is dead, long live print()

02 July 2021 alert() is dead, long live print()
Research article

View all articles
Research article

Read article

Meet the Researchers

James Kettle

James Kettle

Director of Research

Michael Stepankin

Michael Stepankin

Researcher

Gareth Heyes

Gareth Heyes

Researcher