Top 10 winner

Hunting ASynchronous Vulnerabilities

Hunting asynchronous vulnerabilities

James Kettle · PortSwigger Research · 15 September 2015

Bugs in background threads and second-order flows produce no output and no measurable delay, so they survive normal scanning. Sending payloads that make the target itself call back out of band, usually over DNS, exposes them, with context-agnostic callbacks given for XML injection and XXE, SQL injection on PostgreSQL, MySQL, SQLite, MSSQL and Oracle, shell command injection and blind XSS.

Record

Document

Hunting asynchronous vulnerabilities

Researcher

James Kettle

Published by

PortSwigger Research

Date

15 September 2015

Topic

Other

In the archive

• Ranked #10 in the 2015 Top 10 Web Hacking Techniques

Related sources

• Hunting Asynchronous Vulnerabilities Whitepaper
• 2016 - James Kettle - Hunting Asynchronous Vulnerabilities

Tags

• xxe
• sqli
• command-injection
• xss
• dns
• injection
• tooling
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.