Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Research Articles

Document My Pentest: you hack, the AI writes it up!

23 April 2025Document My Pentest: you hack, the AI writes it up!

SAML roulette: the hacker always wins

18 March 2025SAML roulette: the hacker always wins

Shadow Repeater

AI-enhanced manual testing20 February 2025Shadow RepeaterAI-enhanced manual testing

04 February 2025

Bypassing character blocklists with unicode overflows

28 January 2025Bypassing character blocklists with unicode overflows

Stealing HttpOnly cookies with the cookie sandwich technique

22 January 2025Stealing HttpOnly cookies with the cookie sandwich technique

08 January 2025

Bypassing WAFs with the phantom $Version cookie

04 December 2024Bypassing WAFs with the phantom $Version cookie

New crazy payloads in the URL Validation Bypass Cheat Sheet

29 October 2024New crazy payloads in the URL Validation Bypass Cheat Sheet

Concealing payloads in URL credentials

23 October 2024Concealing payloads in URL credentials

Introducing the URL validation bypass cheat sheet

03 September 2024Introducing the URL validation bypass cheat sheet

Gotta cache 'em all: bending the rules of web cache exploitation

08 August 2024Gotta cache 'em all: bending the rules of web cache exploitation

Splitting the email atom: exploiting parsers to bypass access controls

07 August 2024Splitting the email atom: exploiting parsers to bypass access controls

Listen to the whispers: web timing attacks that actually work

07 August 2024Listen to the whispers: web timing attacks that actually work

Fickle PDFs: exploiting browser rendering discrepancies

How browser rendering can alter content 09 July 2024Fickle PDFs: exploiting browser rendering discrepanciesHow browser rendering can alter content

Previewing three publications coming to DEF CON & Black Hat USA

02 July 2024Previewing three publications coming to DEF CON & Black Hat USA

New exotic events in the XSS cheat sheet

11 June 2024New exotic events in the XSS cheat sheet

Refining your HTTP perspective, with bambdas

29 May 2024Refining your HTTP perspective, with bambdas

Introducing SignSaboteur: forge signed web tokens with ease

22 May 2024Introducing SignSaboteur: forge signed web tokens with ease

Making desync attacks easy with TRACE

19 March 2024Making desync attacks easy with TRACE

Using form hijacking to bypass CSP

05 March 2024Using form hijacking to bypass CSP

19 February 2024

Hiding payloads in Java source code strings

23 January 2024Hiding payloads in Java source code strings

09 January 2024

Finding that one weird endpoint, with Bambdas

12 December 2023Finding that one weird endpoint, with Bambdas

Blind CSS Exfiltration: exfiltrate unknown web pages

05 December 2023Blind CSS Exfiltration: exfiltrate unknown web pages

The single-packet attack: making remote race-conditions 'local'

18 October 2023The single-packet attack: making remote race-conditions 'local'

How to build custom scanners for web security research automation

03 October 2023How to build custom scanners for web security research automation

Smashing the state machine

the true potential of web race conditions09 August 2023Smashing the state machinethe true potential of web race conditions

Exploiting XSS in hidden inputs and meta tags

11 July 2023Exploiting XSS in hidden inputs and meta tags

How I choose a security research topic

14 June 2023How I choose a security research topic

Bypassing CSP via DOM clobbering

05 June 2023Bypassing CSP via DOM clobbering

Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

28 April 2023Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

The curl quirk that exposed Burp Suite & Google Chrome

28 March 2023The curl quirk that exposed Burp Suite & Google Chrome

Exploiting prototype pollution in Node without the filesystem

23 March 2023Exploiting prototype pollution in Node without the filesystem

Server-side prototype pollution: Black-box detection without the DoS

15 February 2023Server-side prototype pollution: Black-box detection without the DoS

08 February 2023

04 January 2023

Hijacking service workers via DOM Clobbering

29 November 2022Hijacking service workers via DOM Clobbering

Stealing passwords from infosec Mastodon - without bypassing CSP

15 November 2022Stealing passwords from infosec Mastodon - without bypassing CSP
View older posts