Collected research

Backslash Powered Scanning: hunting unknown vulnerability classes

James Kettle · PortSwigger · 4 November 2016

Explains how generic input transformations and differential response analysis can identify unfamiliar server-side injection behavior. Backslash Powered Scanner develops observations through iterative checks while distinguishing confirmed vulnerabilities from leads requiring manual review.

Record

Researcher

James Kettle

Published by

PortSwigger

Date

4 November 2016

Topic

Other

In the archive

• Collected in the 2016–17 research round

Related sources

• Backslash Powered Scanning: hunting unknown vulnerability classes (Whitepaper) Whitepaper
• Backslash Powered Scanning: hunting unknown vulnerability classes (Slides) Slides
• Backslash Powered Scanner
• Distribute Damage
• ActiveScan++
• Backslash Powered Scanning (embedded video)

Tags

• tooling
• fuzzing
• injection
• detection
• sqli
• ssti
• owasp-a03-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 September 2026.