Collected research

Till REcollapse: : Fuzzing the web for mysterious bugs

Till REcollapse

0xacb · 0xacb.com

REcollapse fuzzes single bytes at regex pivot positions - the start and end of an input, either side of separators, and characters that normalisation folds - to get past validation and sanitisation that a later transformation undoes. Bypasses found this way include open redirects, web application firewall evasion and zero-interaction account takeover through normalised email addresses.

Record

Document

Till REcollapse

Researcher

0xacb

Published by

0xacb.com

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• REcollapse tool
• BSidesLisbon 2022 slides Whitepaper
• NahamCon 2022 EU slides Whitepaper
• [BSL2022] Till REcollapse: fuzzing the web for mysterious bugs - André Baptista
• #NahamCon2022EU: Till REcollapse: Fuzzing the Web for Mysterious Bugs by @0xacb

Tags

• filter-bypass
• waf-bypass
• unicode
• encoding
• auth-bypass
• open-redirect
• fuzzing
• tooling
• bug-bounty
• owasp-a01-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of 0xacb, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.