Top 10 Web Hacking Techniques

2024

The 2024 Top 10 Web Hacking Techniques: all 10 winners and 149 nominated and collected techniques, each with its researcher, summary and preserved source.

149 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! Orange Tsai
Apache's modules share one request_rec and read its fields differently. mod_rewrite treats r->filename as a URL and truncates at an encoded ?, so <Files admin.php> auth falls to admin.php%3Fooo.php, which PHP-FPM splits…
#2 SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level Paul Gerste
Database client drivers write a message's size into a four-byte length field, so a parameter of about four gigabytes makes that integer overflow and the tail of the attacker's string is read by the database as a fresh…
#3 Unveiling TE.0 HTTP Request Smuggling: Discovering a Critical Vulnerability in Thousands of Google Cloud Websites Paolo Arnolfo and Guillermo Gregorio
Introduces TE.0 request smuggling, where the front end honours chunked Transfer-Encoding but the back end treats the body as empty, the chunked counterpart of CL.0. Against Google Cloud Load Balancers left on HTTP/1.1…
#4 WorstFit: Unveiling Hidden Transformers in Windows ANSI! Orange Tsai
Windows converts UTF-16 to the ANSI code page with Best-Fit mappings: fullwidth quote U+FF02 becomes ", yen U+00A5 becomes \, soft hyphen becomes -. GetCommandLineA and the CRT behind plain main() apply this after…
#5 Exploring the DOMPurify library: Bypasses and Fixes kevin_mizu
Chains HTML parser quirks, deep-nesting node flattening, insertion-mode popping, form and table reordering, and DOM clobbering of the sanitiser's own depth counter, into full mutation-XSS bypasses of three DOMPurify…
#6 DoubleClickjacking: A New Era of UI Redressing Blog
The attacker's page opens a window asking for a double-click. That window uses window.opener.location to swap the parent to a sensitive page such as an OAuth consent prompt, then closes itself on the first click's…
#7 CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js Thomas Rinsma
PDF.js compiles each glyph's drawing commands into a JavaScript function body and inserts the font matrix values unquoted, but a PDF font dictionary can supply its own matrix holding a string instead of numbers. Merely…
#8 OAuth Non-Happy Path to ATO Omid Rezaei
Switching response_type from code to id_token derails the callback into an error branch that redirects to the Referer with no parameters, while the tokens sit in the fragment, which server-side 3xx redirects preserve…
#9 ChatGPT Account Takeover - Wildcard Web Cache Deception Harel Security Research
Cloudflare cached everything under a share path without decoding a percent-encoded path traversal, while the origin decoded and normalised it. Requesting a traversing share URL therefore caches the victim's auth token…
#10 Hijacking OAUTH flows via Cookie Tossing Elliot Ward
Extends the little-documented cookie tossing technique, in which control of a subdomain permits setting cookies scoped to the parent domain with a narrow Path so they take precedence on chosen endpoints. Applied to a…

Also collected

[EN] Multi-sandwich attack with MongoDB Object ID or the scenario for real-time monitoring of web application invitations: a new use case for the sandwich attack aeth.cc
MongoDB ObjectIDs used as invitation tokens carry a second-resolution timestamp, a process value and an incrementing counter, so a token minted for someone else lies inside the rectangle bounded by two tokens the…
[EN] Unsecure time-based secret and Sandwich Attack aeth.cc
Password-reset tokens built from PHP uniqid(), time(), UUIDv1 or MongoDB ObjectIDs are recoverable because the HTTP Date header reveals the request instant, and hashing them in md5 or sha256 only means the attacker…
[Quick note] How to build CodeQL DB with closed-source project(.NET Assembly) | by Jang Jang
A practitioner note on building CodeQL databases for closed-source .NET applications, so that queries can follow call graphs through compiled dependencies rather than stopping at them. It collects the managed assemblies…
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies hackermondev
Zendesk threads replies to support+id{id}@company.com and adds any CC'd address to that ticket without authenticating the sender, so a spoofed mail from the requester's address CCing the attacker yields the whole ticket…
A Flushing Attack on the DNS Cache Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt
Presents DNS CacheFlush, a denial-of-service attack that thrashes rather than poisons a recursive resolver's cache. Authoritative replies carrying many server names, such as long referral responses or CNAME chains…
A New Attack Interface In Java Application Xu Yuanzhen and Peter Mularien
Treats attacker-controlled JDBC connection properties as an attack surface: across seven database drivers they yield JNDI injection, log-file writes that plant a webshell, multibyte-charset SQL injection, arbitrary…
A Race to the Bottom - Database Transactions Undermining Your AppSec Viktor Chuchurski
Reading a row, checking it, then writing it inside a database transaction is still racy: default isolation levels take no lock on the read, so concurrent requests all pass the check. Firing parallel requests, ideally…
a-deep-dive-into-openapi-security.pdf Andrei Agape
Treats an API's OpenAPI specification as a graph in a graph database, with endpoints, parameters and objects as nodes, so design flaws can be queried much as directory attack paths are. The queries surface sensitive…
Abusing Arbitrary File Deletes to Escalate Privilege and Other Great Tricks Simon Zuckerbraun
Turns weak Windows filesystem primitives, an arbitrary file or folder delete, move or rename, into full SYSTEM privilege escalation by seizing the Windows Installer rollback folder and planting forged rollback scripts…
Abusing Intended Feature And Bypassing Facial Recognition.pptx Ishwar Kumar
An app's signup requires a live face-detection step, with only two criteria: the face must be human and looking straight ahead. Testing shows a physical photograph held to the camera blurs and is rejected, but a…
Account Takeover due to DNS Rebinding Yashar Shahinzadeh
Examines a login-token handoff that continues to trust a custom domain after its DNS destination changes. The owner verifies the domain, obtains TLS credentials and repoints its records; a subsequent authentication flow…
Android Exploit to RCE: $5000 Bounty Yashar Shahinzadeh
Frida hooks on Conscrypt's checkTrustedRecursive and on Java's Cipher strip TLS pinning and a second app-layer AES whose key exchange rides in an X-Cookie header (seed, key length, two IVs, HMAC). The decrypted body…
Another vision for SSRF @phor3nsic_br
Turns a low-impact SSRF that acts as a configurable proxy on a subdomain into client-side session theft. The attacker points the proxy at their own server and serves content through the vulnerable subdomain, so a victim…
Anyone can Access Deleted and Private Repository Data on GitHub Joe Leon
Commits pushed to a GitHub fork or upstream repository stay reachable from every repository in the fork network forever, surviving fork deletion, repository deletion and private-to-public transitions. Anyone who guesses…
Arc Browser UXSS, Local File Read, Arbitrary File Creation and Path Traversal to RCE Renwa and @RenwaX23
Arc's undocumented arc://boost/play/ endpoint builds and installs a browser extension from a compressed JSON blob in the URL. Permissions come from manifest.json while the install screen reads boost.config.json, so the…
Arcanum: Detecting and Evaluating the Privacy Risks of Browser Extensions on Web Pages and Web Content Qinge Xie, Manoj Vignesh Kasi Murali, Paul Pearce and Frank Li
Presents Arcanum, a dynamic taint-tracking system for Chrome extensions that follows user content out of web pages, defining taint sources and sinks researchers can attach to page elements at runtime under current…
Argus: All your (PHP) Injection-sinks are belong to us Rasoul Jahanshahi and Manuel Egele
Argues that injection-vulnerability detection built on hand-curated sink lists misses sinks the language interpreter itself provides, and derives the sink set automatically from PHP interpreter internals instead…
Attacking PowerShell CLIXML Deserialization siteadmin and @Truesec
Analyses PowerShell's CLIXML deserialization, where objects are restored as property bags or rehydrated as live objects, and shows the default rehydrating types supply usable gadgets: a CIM ping type triggering…
Authorization bypass due to cache misconfiguration Rikesh Baniya
A short-lived server-side cache on an e-commerce admin GraphQL endpoint stored the order-listing response without including the caller's authorisation in the cache key. This bug bounty write-up shows that a…
AuthSaber: Automated Safety Verification of OpenID Connect Programs Yuan Tian and @GetResearchDev
This is a publication listing page from a university lab site for a conference paper on automated safety verification of OpenID Connect implementations, presented at the 31st ACM Conference on Computer and…
Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140) spaceraccoon.dev
Examines the Clipboard API as an under-analysed source of untrusted input, since any page can silently rewrite what a visitor copies. In Excalidraw, pasted element data carried a link value assigned to an SVG anchor's…
Bench Press: Leaking Text Nodes with CSS pspaul and @pspaul95
CSS injected into a <style> tag, under a CSP that blocks scripts and remote fonts. Each hex digit gets an @font-face with unicode-range and descent-override for a unique height; a view-timeline animation reads the…
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit RyotaK
Extends the single-packet attack past its roughly 1,500-byte ceiling by splitting a large TCP segment across IP fragments and sending them out of order, withholding the one carrying the first sequence number. The server…
Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs Matan Berson
An NFT site rendered bidder names inside a Vue-mounted element but truncated them to eight characters, leaving four characters of template per bid. Many crafted names and tiny bids build an arbitrary string, reach the…
Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls Qi Wang, Jianjun Chen, Zheyu Jiang, Run Guo, Ximeng Liu, Chao Zhang and Haixin Duan
WAF Manis fuzzes grammar-derived malformed HTTP requests to find parsing disagreements between a web application firewall and the backend framework: duplicate Content-Type headers, malformed multipart boundaries…
Breaking Down Multipart Parsers: File upload validation bypass @AndreaTheMiddle and Andrea Menin
PHP, Busboy and Flask parsers disagree with the WAFs in front of them about one multipart/form-data body. Duplicated name or filename parameters, duplicated Content-Disposition headers, a broken CRLF between headers and…
Bypassing CSP via URL Parser Confusions: XSS on Netlify’s Image CDN sudi
A stored cross-site scripting finding on Netlify's image CDN endpoint. An upload allowlist that trusted the declared Content-Type let arbitrary HTML be hosted on a whitelisted CDN origin, and the image proxy served it…
Bypassing WAFs to Exploit CSPT Using Encoding Levels Matan Berson
Client-side path traversal payloads can be hidden from a WAF by exploiting how many times the WAF and the application each URL-decode. Encode above the WAF's level, pad with segments only the WAF decodes, or use an…
Bypassing WAFs with the phantom $Version cookie Zakhar Fedotkin
A leading $Version=1 makes Tomcat and Spring fall back to RFC2109 cookie parsing, where values may be quoted and backslash escapes are unescaped, and Python's SimpleCookie decodes octal escapes inside quotes. Writing…
CDN Cannon: Exploiting CDN Back-to-Origin Strategies for Amplification Attacks Ziyu Lin, Zhiwei Lin, Ximeng Liu, Jianjun Chen, Run Guo, Cheng Chen and Shaodong Xiao
Identifies a new amplification class, Back-to-Origin Amplification, in the pre-fetch and request-rewriting strategies CDNs use when fetching content from origin servers. Because these back-to-origin behaviours favour…
Chaining Three Bugs to Access All Your ServiceNow Data Adam Kues
ServiceNow renders Jelly templates twice, and any query parameter binds to a template variable, so ?jvar_page_title= injects into a no_escape title. The HTML sanitiser permits <style>, whose contents the XML parser…
Class Pollution in Ruby: A Deep Dive into Exploiting Recursive Merges Raúl Miján
A recursive merge writing JSON keys onto object attributes via instance_variable_set lets attacker keys shadow methods: to_s set to Admin passes an authorisation check, and protected_methods set to a string reaches…
Cloudflare Pagesにおける権限昇格と任意ページの改竄 RyotaK
Three chained flaws in the Cloudflare Pages build platform: a symlinked redirects file made the deploy step read arbitrary files as root, a version variable let npm install and run an attacker tarball as root, and path…
Concealing payloads in URL credentials Gareth Heyes
document.URL keeps the credentials part of a URL while location strips it, and Chrome and Firefox hide it from the address bar, so https://'-alert(1)-'@example.com carries an invisible payload. Any script that reads…
CORS vulnerabilities: Weaponizing permissive CORS configurations Thomas Stacey
A scan of every domain in a managed pentest estate for permissive Cross-Origin Resource Sharing, followed by exploitation, argues such findings are routinely under-rated. The article classifies the origin-validation…
Crashing servers with digits Martin Matyja
Submitting a number with millions of digits after the decimal point, or the same compactly in exponent notation, makes a server spend tens of seconds parsing a single request, so a handful of requests exhaust CPU and…
Cross Window Forgery: A New Class of Web Attack evil.blog
A URL fragment matching an element's id focuses that element, and pressing Enter or Space then activates it. The attacker opens target.com/oauth/allow?appId=evil#allow-button in a 1x1 window moved offscreen and asks the…
CVE-2023-5480: Chrome new XSS Vector Vsevolod Kokorin
Chrome's Payment Request API fetched a payment method manifest directly from a URL and just-in-time installed the service worker it named. Any site serving user-uploaded files under their own MIME type could be made to…
CVE-2023–50220 — Inductive Automation Ignition XML Deserialization to RCE Petrus Viet and @VietPetrus
Ignition's /data/status/store_forward_import/<store> route accepts a multipart XML file. An element <data flavor="__datasourcedata__" subtype=""> makes QuarantinedXmlImporter pick HistoryFlavor's Base64XmlReader, which…
CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again! Orange Tsai
A short note on CVE-2024-4577 published alongside the official PHP advisory, written while the author prepared his Black Hat Apache talk. It reports that the php-cgi argument-injection patch reviewed and trusted for…
CVE-2024-50603: Aviatrix Network Controller Command Injection Vulnerability Jakub Korepta
Analysis of CVE-2024-50603, an unauthenticated remote code execution flaw in Aviatrix Controller 7.x cloud networking appliances. A PHP wrapper around the controller's command-line tool applied escapeshellarg to most…
Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting Robin Kirchner, Jonas Möller, Marius Musch, David Klein, Konrad Rieck and Martin Johns
Addresses blind cross-site scripting, where injected input reaches an internal backend that returns no feedback, leaving conventional detection with nothing to observe. The paper synthesises polyglot payloads that…
Databricks JDBC Attack via JAAS pyn3rd
The Databricks JDBC driver accepts a JAAS config property pointing at a remote URL, so a victim using an attacker-supplied connection string fetches a config naming a JNDI login module with an attacker LDAP provider…
Delinea Protocol Handler - Remote Code Execution via Update Process (CVE-2024-12908) David Cash and Richard Warren
The sslauncher:// URI handler takes an ssurl parameter and, with autoUpdateEnabled=true, fetches an update over SOAP from that host, extracts the returned zip and runs its setup.bat msiexec line. The MSI must be…
Devfile file write vulnerability in GitLab joern
A walkthrough of CVE-2024-0402, an arbitrary file write in GitLab. GitLab's Ruby validation blocks the devfile 'parent' key, but a YAML parser differential smuggles it through: the local '!binary' tag decodes to a…
Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction Bofei Chen, Lei Zhang, Xinyou Huang, Yinzhi Cao, Keke Lian, Yuan Zhang and Min Yang
Finds Java deserialization gadget chains by searching bottom-up from sinks to sources over reusable gadget fragments, cutting static search cost from exponential to polynomial, then fuzzes using a diagram of dataflow…
Encoding Differentials: Why Charset Matters Stefan Schiller
Omitting the charset attribute from a Content-Type header is itself an XSS-enabling defect, because browsers then auto-detect the encoding of the response body. Injecting ISO-2022-JP escape sequences flips the assumed…
Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins Yaniv Nizry
Two vulnerabilities in Jenkins' built-in command line interface. The args4j parser expands any argument beginning with @ by reading the named file and splitting it into arguments, so a command that echoes unresolved…
Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF Maxence Schmitt
Attacker-controlled input in a URL fragment, query or stored record traverses the path a front end builds for its own API call, rerouting the authenticated request to a different endpoint. That revives CSRF despite…
Exploiting Exchange PowerShell After ProxyNotShell: Part 1 - MultiValuedProperty Piotr Bazydło
After ProxyNotShell was patched with a type allow list governing Exchange PowerShell Remoting deserialization, this article shows the allow list itself contains an abusable generic: MultiValuedProperty<T>, whose…
Exploiting Number Parsers in JavaScript bn-modir
parseInt and parseFloat return the first element when handed an array, so a range validator comparing an array against a number fails open and the unchecked first element still reaches the database query. Combined with…
Exploiting the Unexploitable Insights from the Kibana Bug Bounty Mikhail Shcherbakov
Kibana's synthetic-monitoring feature runs user-pasted JavaScript by design, and NET_RAW on the container turned that into ARP spoofing of the cluster. CodeQL then found server-side prototype pollution in the kibana.yml…
Exploring Javascript events & Bypassing WAFs via character normalization 0x999 and @_0x999
Catalogues JavaScript event handlers that fire with no user interaction, then reaches arbitrary script execution from them without parentheses or backticks by overwriting toString or an Error name. It bypasses eight…
Facebook Messenger Bug Hunting - A Bug's E2E Lifecycle Luke McLaren and Farah Hawa
Three Meta Messenger bugs: a URL check that treats any domain merely starting with the brand name as genuine, so phishing links get official branding in encrypted chats; an effect icon URL with a bad path that crashes…
Few steps on how to take over a whole application Sebastian Jeż
An audit-trail endpoint returned other users' records with their password reset tokens embedded, and only the last six hexadecimal characters varied. Brute-forcing that small range let a low-privileged user harvest…
Fickle PDFs: exploiting browser rendering discrepancies Zakhar Fedotkin
A PDF form text field carries both a value and a widget annotation with its own appearance stream. Chrome's PDFium, Firefox's PDF.js and Google Drive draw the annotation, while Safari and macOS Preview ignore it and…
From Arbitrary File Write to RCE in Restricted Rails apps Research Team Conviso and @conviso
An arbitrary file write in a Rails app confined to a few writable directories becomes code execution through Bootsnap's compiled-bytecode cache. The attacker forges the cache key for a file the app requires, writes…
FuzzCache: Optimizing Web Application Fuzzing Through Software-Based Data Cache Penghui Li and Mingxue Zhang
Profiling PHP web applications under fuzzing shows roughly half of execution time is spent fetching data from databases and the network, and that identical data is fetched repeatedly across trials. This work adds a…
Gem::SafeMarshal escape Luke Jahnke
Two escapes from Ruby's allow-list deserialiser: the permitted Date class calls the unrestricted loader on attacker data, and a length confusion in its instance-variable handling, where a particular string length makes…
Generic and Automated Drive-by GPU Cache Attacks from the Browser Lukas Giner, Roland Czerny, Christof Gruber, Fabian Rauscher, Andreas Kogler, Daniel De Almeida Braga and Daniel Gruss
Compute shaders in WebGPU let an ordinary web page build eviction sets and run a cache attack against a GPU's L2 cache with no user interaction. Automated across 11 desktop GPUs, it demonstrates inter-keystroke timing…
GHSL-2024-312: Arbitrary code execution and secret exfiltration in Azure API Management Developer Portal pwntester and @pwntester
A GitHub Actions workflow echoed the JSON of every open issue into a file through Bash interpolation. Anyone who opens an issue whose title or body contains backticks breaks out of the quoting and runs commands on the…
GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes Eric Cornelissen, Mikhail Shcherbakov and Musard Balliu
Studies prototype pollution gadgets inside JavaScript runtimes rather than libraries, arguing that runtime gadgets affect every application executing on them. GHunter, a lightweight dynamic taint analysis built into V8…
GitHub Actions exploitation: untrusted input @Synacktiv
Three GitHub Actions misconfigurations, untrusted expression interpolation into run scripts, unvalidated artifacts consumed by follow-up workflows, and explicit checkouts of fork code under a privileged trigger, let an…
GitHub Enterprise SAML Authentication Bypass Harsh Jaiswal and Rahul Maini
Explains GitHub Enterprise SAML authentication failures caused by differences between the assertions validated for signatures and those consumed after decryption. Reconstructs the vulnerable processing order and a…
Go Go XSS Gadgets: Chaining a DOM Clobbering Exploit in the Wild Brett Buerhaus, Sam Curry and Maik Robert
A reflected XSS on a sibling domain is used to postMessage into an auth portal whose listener writes attacker HTML through innerHTML; DOM clobbering of an undeclared global, via a named iframe holding an anchor, makes a…
Gotta cache 'em all: bending the rules of web cache exploitation Martin Doyhenard
Web caches key stored responses on the URL, but the CDN or proxy computing that key and the origin server routing the request often parse the URL differently. This paper maps delimiter and normalisation discrepancies…
Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies Bahruz Jabiyev, Anthony Gavazzi, Kaan Onarlioglu and Engin Kirda
Chains of reverse proxies, caches and API gateways each parse an HTTP request, and small disagreements between them enable request smuggling and cache poisoning. This paper presents Gudifu, a graybox differential fuzzer…
Hacking Apple with SQL Injection Harsh Jaiswal and Rahul Maini
Describes custom analysis of CFML applications to identify SQL injection sinks and trace their reachability. The Apple travel-portal case demonstrates unauthorized account access; execution through scheduled tasks was…
Hacking Giants Through a Race Condition in GitHub Actions Artifacts Yaron Avital
Documents how GitHub Actions build artifacts leak credentials: the checkout action persists the ephemeral GITHUB_TOKEN into .git and a popular linter logs environment variables, so uploading a whole workspace publishes…
Hacking Kia: Remotely Controlling Cars With Just a License Plate Sam Curry and @samwcyo
Kia's owner site and dealer portal front the same backend API gateway through a header-driven proxy servlet. This case study shows the dealer portal accepted accounts created through the consumer registration endpoint…
Hacking Millions of Modems (and Investigating Who Hacked My Modem) Sam Curry and @samwcyo
An authorization bypass in a major US ISP's business customer portal let any unauthenticated request succeed simply by being replayed, exposing roughly 700 REST endpoints on a reverse-proxied Spring backend. Swagger…
Half Measures and Full Compromise: Exploiting Microsoft Exchange PowerShell Remoting Piotr Bazydło
An index page for the author's Exchange PowerShell Remoting research, linking the OffensiveCon 2024 talk and slides and four Zero Day Initiative posts. It states the result: after ProxyNotShell, cmdlet arguments remain…
Hello Lucee! Let us hack Apple again? Harsh Jaiswal and Rahul Maini
Lucee, an open-source CFML application server, exposes several paths that evaluate attacker-supplied strings as CFML or deserialise them as Java objects. This case study traces a REST mapping that deserialises request…
How an obscure PHP footgun led to RCE in Craft CMS Adam Kues
With register_argc_argv on, PHP fills $_SERVER[argv] from the query string, and Craft CMS reads its CLI options from there without checking the SAPI, so ?--templatesPath= sets the template root from the URL. http and…
http-garden: Differential fuzzing REPL for HTTP implementations. narfindustries
A REPL that runs dozens of HTTP servers and proxies in containers and compares them directly: a payload is transduced through a proxy, fanned out to the origin servers, and their parsed requests are shown in an…
HTTP/2 CONTINUATION Flood: Technical Details Bartek Nowotarski
HTTP/2 splits oversized header blocks across CONTINUATION frames terminated by the END_HEADERS flag. Withholding that flag leaves many implementations parsing and storing headers indefinitely: the article documents CPU…
Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine blog.lexfo.fr
Turns an output-less PHP file-read into remote code execution using a one-byte glibc iconv overflow. Heap grooming through php filters overwrites a stream bucket so its buffer points anywhere, giving a crashless…
Insecurity through Censorship: Vulnerabilities Caused by The Great Firewall Shubham Shah
Queries answered by a nameserver in China get forged A records whenever a blacklisted keyword such as webproxy.id appears anywhere in the name, even for domains that do not exist, and the answers come from a small pool…
Internet's Invisible Enemy: Detecting and Measuring Web Cache Poisoning in the Wild Yuejia Liang, Jianjun Chen, Run Guo, Kaiwen Shen, Hui Jiang, Man Hou, Yue Yu and Haixin Duan
HCache mutates the request line, headers and body to find fields the cache omits from its key but the origin still reacts to, then sends normal, attack and validation requests behind a cache buster to confirm the error…
Introducing lightyear: a new way to dump PHP files blog.lexfo.fr
Speeds up dumping files through a blind PHP file-read primitive: iconv charset conversions remap the base64 alphabet so a chosen digit becomes a newline, and PHP's lenient dechunk filter then strips everything before…
Introducing SignSaboteur: forge signed web tokens with ease Zakhar Fedotkin
Signed web tokens beyond JWT, including the session formats used by Django, Flask, Express and Rails, are widely deployed with default or leaked signing secrets, and their bespoke encodings make them easy to overlook…
Introducing the URL Validation Bypass Cheat Sheet Zakhar Fedotkin
URL validation bypasses underlie many instances of SSRF, CORS misconfiguration and open redirection, working by giving parsers an ambiguous URL, yet the known payloads are scattered and poorly documented. This article…
JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory srcincite.io
A JNDI lookup pointed at a Tomcat user-database factory lets an attacker set its pathname and readonly properties, so the factory fetches attacker-hosted XML and writes it back out to a chosen path. Chaining a bean…
Joomla: PHP Bug Introduces Multiple XSS Vulnerabilities Stefan Schiller
Multiple cross-site scripting vulnerabilities in Joomla (CVE-2024-21726) are traced to divergent handling of invalid UTF-8 by two PHP mbstring functions: mb_strpos restarts parsing at an invalid byte while mb_substr…
Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug Davwwwx
Chains a client-side path traversal in JupyterLab's clone workspace parameter with an open redirect reachable because Python's URL parser finds no netloc in a triple-slash URL, and a Chromium bug that preserved custom…
Leaking ObjRefs to Exploit HTTP .NET Remoting Markus Wulftange
Attacking .NET Remoting over HTTP needs a valid object URI. Sending GET with a __RequestVerb: POST header reaches the formatter sink, whose catch block serialises a ReturnMessage carrying the LogicalCallContext…
Limitations are just an illusion – advanced server-side template exploitation with RCE everywhere Alex Brumen
Alex Brumen builds self-contained, quote-free SSTI-to-RCE payloads for Jinja2, Mako, Twig, Smarty, Blade, Groovy, FreeMarker and Razor. Each payload derives command strings from default runtime or template features…
Listen to the whispers: web timing attacks that actually work James Kettle
Web timing attacks have historically been lab-bound; this research reduces the reliably exploitable differential to roughly 200 microseconds and validates its techniques against a test bed of 30,000 live sites. It shows…
Lost in Translation - WAF Bypasses By Abusing Data Manipulation Processes Ryan Barnett
Abusing Unicode normalization to defeat input validation and WAF signatures, presented as an impedance mismatch between layers - browser, CDN or WAF, framework, database - that decode, normalize or truncate text…
MongoDB NoSQL Injection with Aggregation Pipelines Soroush Dalili
An application that passes user input into MongoDB's aggregation stage lets NoSQL injection escape the single collection a find would confine it to: lookup and union stages read other collections such as users, while…
MSSQL Identified as Vulnerable to Emoji String Exploitation DecryptLOL and @decrypt_lol
Microsoft SQL Server's Windows Unicode collation compares a goblin emoji as equal to an empty string, so a login lookup matching a supplied email returns accounts whose email is blank. That lets an attacker brute-force…
NetModule Router Software Race Condition Leads to Remote Code Execution Nuri Çilengir
NetModule NRSW's gnssAutoAlign.php escapes device_id before starting the alignment helper, but the other branch runs exec("kill $(cat " . PID_FILENAME . ")") with the raw id concatenated into that path, and it is…
Next.js and cache poisoning: a quest for the black hole zhero_web_security
Three cache-poisoning issues in Next.js, each storing a useless response under a normal cache key and so denying service: the x-middleware-prefetch header returning an empty JSON body for server-rendered pages…
Old new email attacks blog.slonser.info
Email address parsers disagree about the bracketed domain-literal form: several permit CR LF inside the brackets, letting an attacker inject SMTP commands through an application's recipient field and send arbitrary mail…
Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials David Klein and Martin Johns
Generates 12 million mutation-prone HTML fragments, sanitizes each with 11 server-side sanitizers, then renders the output in three browsers in both document and fragment mode, comparing parse trees by a bag-of-XPaths…
Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Interactions Shubham Agarwal, Aurore Fass and Ben Stock
An attacker page overwrites 571 global JavaScript APIs and 51 property accessors before an extension's injected script runs, logging each call's name, arguments, caller source and stack trace. It also enumerates globals…
Piloting Edge Copilot @speakerdeck and Jun Kokatsu
An attack chain against Edge's Copilot sidebar, whose internal WebUI holds privileged extension APIs and camera and microphone access while framing Bing. A postMessage listener assigning attacker data to an iframe src…
Pixel Thief: Exploiting SVG Filter Leakage in Firefox and Chrome Sioli O'Connell, Lishay Aben Sour, Ron Magen, Daniel Genkin, Yossi Oren, Hovav Shacham and Yuval Yarom
Revisits pixel-stealing attacks against SVG filters, which browser vendors had addressed by removing timing variation from filter implementations. The work shows those fixes are insufficient: cache-based side-channel…
plORMbing your Django ORM Alex Brown
User JSON passed into QuerySet.filter(**request.data) lets an attacker choose column and operator, so password__startswith turns response length into a character-by-character oracle. Relational lookups go further…
plORMbing your Prisma ORM with Time-based Attacks Alex Brown
In Prisma a controlled where clause picks field and operator, and nested some objects loop a many-to-many back on itself to reach users and unpublished rows the endpoint never exposes. With no visible response…
POST to XSS: Leveraging Pseudo Protocols to Gain JavaScript Evaluation in SSO Flows Lauritz Holtmann
A protocol-level cross-site scripting pattern in POST-based single sign-on: the OAuth 2.0 form_post response mode and the SAML HTTP-POST binding are implemented as auto-submitting HTML forms, so a redirect_uri or…
ReactAppScan: Mining React Application Vulnerabilities via Component Graph Zhiyong Guo, Mingqing Kang, V.N. Venkatakrishnan, Rigel Gjomemo and Yinzhi Cao
Existing web vulnerability scanners do not model React Data Flow, the indirect passing of data between components via props and state, and CodeQL's coarse object representation misses it as well. This work builds a…
Remote Code Execution with Spring Properties srcincite.io
A restricted upload that can only write allow-listed extensions into a Spring Boot application's working directory becomes remote code execution by dropping a configuration file there: Spring loads it, an attacker-set…
Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule @AndreaTheMiddle and Andrea Menin
WAF response-body rules meant to stop SQL error and web shell leakage match plain strings with no special characters: ORA-1234, Dynamic SQL Error, OracleDriver, ---ASL-CONFIG-FILE---. Storing one in a review, username…
Rise of Inspectron: Automated Black-box Auditing of Cross-platform Electron Apps Mir Masood Ali, Mohammad Ghasemisharif, Chris Kanich and Jason Polakis
Presents Inspectron, an automated black-box dynamic analysis framework that audits packaged Electron applications for deviations from the framework's recommended security configuration. The work shows that bundling a…
Rook to XSS: How I hacked chess.com with a rookie exploit Jacob
A bug bounty case study showing that HTML sanitisation applied before later server-side rewriting can be undone. A large chess site re-uploaded remote images referenced in its rich-text editor, and the rewritten…
Ruby 3.4 Universal RCE Deserialization Gadget Chain Luke Jahnke
Refits the universal Ruby deserialisation gadget chain for Ruby 3.4: reaches the URI class through RubyGems' vendored copy via an autoload, swaps the zip sink for tools that ship in official Ruby images, and hides the…
Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) Harsh Jaiswal and Rahul Maini
SAML assertion integrity rests on the digest inside the signed SignedInfo block matching a recomputed digest of the assertion. This analysis of CVE-2024-45409 shows Ruby-SAML read that digest with an unanchored XPath…
Secret Web Hacking Knowledge: CTF Authors Hate These Simple Tricks Philippe Dourassov
A CTF talk on unintended solutions whose novel finding is that exceeding PHP's parameter limit raises a warning before page code runs, so the server never sends headers such as CSP, Cache-Control or Content-Type. It…
Shared Storage worklet queue and termination channels anisenoff
Demonstrates that Shared Storage writes inside a worklet alter completion times of writes issued outside it. Histograms expose otherwise hidden worklet activity through contention in the storage API, motivating…
SMTP Smuggling - Spoofing E-Mails Worldwide Timo Longin
Outbound and inbound SMTP servers disagree on which byte sequence ends message data, so a sequence such as LF dot CRLF passes one server unfiltered and is read as end-of-data by the next. An attacker with any account at…
SnailLoad: Exploiting Remote Network Latency Measurements without JavaScript Stefan Gast, Roland Czerny, Jonas Juffinger, Fabian Rauscher, Simone Franza and Daniel Gruss
Presents SnailLoad, a remote side channel in which a victim merely downloading an asset from an attacker-controlled server leaks activity on their machine through variations in network latency, requiring no JavaScript…
SOQL injection Adam Borczyk
A Salesforce-backed application proxied arbitrary object queries through a path parameter, reaching a REST query API that rejects direct calls. With row-level security not enforced, the tester enumerated over 3,000…
Source Code Disclosure in ASP.NET apps Arseniy Sharoglazov and @_mohemiv
Reports that ASP.NET cookieless session tokens embedded inside a URL path let a request reach files IIS otherwise refuses, because the token is stripped after request filtering has run. On servers configured with…
Spider-Scents: Grey-box Database-aware Web Scanning for Stored XSS Eric Olsson, Benjamin Eriksson, Adam Doupé and Andrei Sabelfeld
Approaches stored XSS detection from the storage side: rather than driving payloads through an application's input paths, Spider-Scents writes marker values directly into the database and maps them to the pages that…
Splitting the email atom: exploiting parsers to bypass access controls Gareth Heyes
Many sites infer organisational membership from the domain part of an email address, which makes disagreement between email parsers a trust decision. This paper shows how RFC-permitted quoting and escapes, encoded-word…
Statamic CMS Sam Schroder
Statamic CMS below 5.17.0 does not sanitise the filename supplied with an assets field on a front-end form, and it derives the storage path from that filename, so an unauthenticated uploader can put ../ sequences in the…
Supply Chain Attacks: A New Era Bruno Halltari and Caue Obici
LavaMoat defends JavaScript builds against malicious dependencies with per-package policy files, dependency-tree naming and scuttling of dangerous globals. The article reports two bypasses: a crafted multi-line…
Teaching the Old .NET Remoting New Exploitation Tricks code-white.com
Three ways to exploit .NET Remoting servers hardened with a low type filter level and Code Access Security. The attacker calls framework methods that assert privileges in order to drop and load a DLL for code execution…
The Ruby on Rails _json Juggling Attack Luke Jahnke
Rails wraps a non-hash JSON body into params under a reserved key but never blocks a request that supplies that key itself, so one body can carry both the single-item hash form and the multi-item array form at once…
Tyranid's Lair: Working your way Around an ACL tiraniddo.dev
Windows guards a protected folder with a conditional access rule granting entry only to tokens carrying a particular security attribute, which cannot be forged without a privileged right. Borrowing such a token from a…
Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences Zhengyu Liu, Kecheng An and Yinzhi Cao
Prototype pollution gadgets found by prior work are direct: a polluted property flows straight to a sink. This paper defines chained gadgets, in which one polluted undefined property alters the control- or data-flow of…
Universal Code Execution by Chaining Messages in Browser Extensions spaceraccoon.dev
Browser extensions that inject content scripts on every origin and forward unvalidated window messages let a hostile page reach the extension's background script by postMessage, and through native messaging the desktop…
Unveiling Rhino’s Blind Spot: Exploiting Custom Code Execution in Apigee CodeSent
Apigee runs customer Java and JavaScript policies side by side. Naming a custom Java class in a package the Rhino class shutter allowlists, and handing an instance of it to a JavaScript policy through a flow variable…
Unveiling the Prototype Pollution Gadgets Finder Raúl Miján
Automates discovery of server-side prototype pollution gadgets by polluting every field of a JSON request with payloads that set optional config properties of Node.js libraries, confirming them out-of-band via callbacks…
User info extraction abusing placeholder injection in Zendesk Rikesh Baniya
Zendesk expands placeholder expressions in ticket fields, including attributes of users copied on a ticket, and sanitises the subject but not the description. This write-up shows that a ticket created with no subject…
Using YouTube to steal your files Ʊ lyra's epic blog
A Google Slides YouTube embed takes only a video id, but a traversal points the iframe at any page on that host. Two token-less redirects, plus a legacy hop that defeats a fetch-metadata check, frame a Docs share dialog…
View State, The unpatchable IIS forever day being actively exploited Zeroed
Vulnerability-oriented Testing for RESTful APIs Wenlong Du, Jian Li, Yanhao Wang, Libo Chen, Ruijie Zhao, Junmin Zhu, Zhengguang Han, Yijun Wang and Zhi Xue
Introduces VOAPI2, a vulnerability-oriented testing framework for RESTful APIs built on the observation that the vulnerability class latent in an endpoint correlates with the functionality its parameter names advertise…
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI Benjamin Harris and Aliz Hammond
The WHOIS server for .mobi moved to whois.nic.mobi and the old dotmobiregistry.net was left to expire, so the researchers bought it for $20 and answered queries clients still had hardcoded: 2.5 million from 135,000…
Web Platform Threats: Automated Detection of Web Security Issues With WPT Pedro Bernardo, Lorenzo Veronese, Valentino Dalla Valle, Stefano Calzavara, Marco Squarcina, Pedro Adão and Matteo Maffei
Proposes a framework that formalises intended security properties of client-side browser mechanisms such as cookie attributes and the Mixed Content policy as first-order-logic Web invariants, then checks browser…
Why Code Security Matters - Even in Hardened Environments Stefan Schiller
Asks whether an arbitrary file write still yields code execution on a read-only filesystem. Because libuv exposes its anonymous signal pipe via /proc, a Node.js process can be fed a forged signal message whose handle…
World of SELECT-only PostgreSQL Injections Maksym Vatsyk
A Go app's SELECT-only injection cannot stack queries because the pgx driver prepares every statement, but the database user holds lo_import/lo_export. Those read the pg_authid filenode off disk; a custom filenode…
Wormable XSS www.bing.com. XSS on www.bing.com context via Maps… pedbap
Bing's /maps/configurable endpoint takes a ?config= URL and loads that JSON from any host, and the config's addLayerFromURL then fetches an attacker-hosted KML file whose placemark description carries raw HTML. The KML…
XSS using dirty Content Type in cloud era Norihide Saito and Eiji Mori
Examines how HTTP Content-Type is parsed differently by RFC 9110 and the WHATWG Fetch standard, which splits the field on commas and takes the last media type, so values such as image/png,text/html defeat prefix…
XSS Vulnerabilities in Excalidraw Affecting Meta (CVE-2024-32472) El Mehdi Mrhassel
Excalidraw's Web Embed feature builds a sandboxed iframe from a user-supplied link. A gist URL carrying a script tag ran with same-origin access, and after that fix the URL sanitiser still passed double quotes, so an…
You can't securely execute commands on Windows RyotaK
On Windows, process creation implicitly launches the command interpreter for batch files, and that interpreter ignores the backslash escaping language runtimes apply to arguments. A user-controlled argument passed to a…
Zero Day Initiative — SolarWinds Access Rights Manager: One Vulnerability to LPE Them All Piotr Bazydło
Six pre-authentication arbitrary file read and delete flaws in SolarWinds Access Rights Manager, reachable through an unauthenticated service on port 55555/tcp whose file-name argument is never validated. Because the…
Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacking, and WAF abuse Sudi, BrunoZero and H4R3L
An XSS in a nonce cookie reflects into every CSP nonce on the domain; an XSS on a neglected subdomain tosses that cookie across the domain, giving persistent XSS nearly everywhere. The chain steals a Google…