Top 10 Web Hacking Techniques
2025
The 2025 Top 10 Web Hacking Techniques: all 10 winners and 109 nominated and collected techniques, each with its researcher, summary and preserved source.
109 records · 10 in the top ten · open this year in the interactive archive
The top ten
-
#1
Blind SSTI
Vladislav Korchagin
Two exploitation techniques for code injection and server-side template injection: Error-Based, which triggers errors whose messages reflect the injected code's output, and Boolean Error-Based Blind, which conditionally…
-
#2
ORM Leaking More Than You Joined For
Alex Brown
ORM Leak attacks let a user who controls a filter expression search sensitive columns such as password hashes or reset tokens character by character. This instalment bypasses Harbor's patches via an expression-parsing…
-
#3
Novel SSRF Technique Involving HTTP Redirect Loops
Shubham Shah and @searchlightsec
A blind SSRF that discloses nothing for a successful response may return the whole response for an error status. Serving a redirect loop that increments the status code through the 3xx range drives the client into that…
-
#4
Lost in Translation: Exploiting Unicode Normalization
Ryan Barnett and Isabella Barnett
How Unicode handling diverges between a front-end proxy or CDN and the back-end application. Decoding errors, overlong encodings, byte truncation, confusables, case mapping and combining diacritics all let input that…
-
#5
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL
@chudyPB and Piotr Bazydlo (@chudyPB)
A missing cast in .NET Framework's SOAP HTTP client proxies lets a file:// or UNC URL make the proxy write its SOAP request body to disk instead of sending it. Attacker-supplied WSDL sets that URL and much of the body…
-
#6
Cross-Site ETag Length Leak
arkark
Turns the ETag header into a cross-site oracle: ETag encodes response size in hex, so crossing a hex-digit boundary changes its length by one byte, echoed back in If-None-Match, which can push a padded request past the…
-
#7
Next.js, cache, and chains: the stale elixir
zhero
The internal x-now-route-matches header makes Next.js treat a server-side-rendered request as static and return a cacheable Cache-Control, while the __nextDataReq parameter turns the response into the pageProps JSON…
-
#8
XSS-Leak: Leaking Cross-Origin Redirects
Salvatore Abello and @salvatoreabello
Chrome schedules equal-priority pending requests by port, then scheme, then host, so with the socket pool exhausted an attacker can race their own request against a victim page's cross-origin request and learn whether…
-
#9
Playing with HTTP/2 CONNECT
blog.flomb.net
In HTTP/2 the CONNECT method tunnels over a single stream instead of hijacking the whole TCP connection, so many tunnels can be multiplexed on one connection. The author builds a Go tool that abuses this against…
-
#10
Parser Differentials: When Interpretation Becomes a Vulnerability
Joern Schneeweisz
Two parsers read the same document differently: duplicate JSON keys, and YAML local versus global binary tags, make a validator and the consumer disagree. One crafted file looks benign to a scanner, ingress or auth…
Also collected
-
8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur
Benjamin Harris, Aliz Hammond and Pinaki Mondal
About 150 abandoned Amazon S3 buckets, still referenced by software, documentation and deployment pipelines, were re-registered and logged over 8 million requests in two months from government, military and Fortune 500…
-
ASP.NET MVC View Engine Search Patterns
Diyan Apostolov
The ASP.NET MVC Razor view engine locates views with internal file-existence checks, so IIS request filtering, which only inspects request URLs, never applies. An attacker holding an arbitrary file write drops a view…
-
Astro framework and standards weaponization
zhero and inzo_
Astro's Node adapter interpolates the unvalidated x-forwarded-proto and x-forwarded-port headers into the request URL, letting an attacker rewrite scheme, host, port and path. A non-special scheme payload delivers a…
-
Attacks via a New OAuth flow, Authorization Code Injection, and Whether HttpOnly, PKCE, and BFF Can Help
Andrey Kuznetsov
An attacker who can run script on any page of an OAuth client's origin starts a fresh authorization code flow in a hidden frame, breaks the flow so the application never consumes the code, and replays the stolen…
-
Automatic Insecurity: Exploring Email Auto-configuration in the Wild
Shushang Wen, Yiming Zhang, Yuxiang Shen, Bingyu Li, Haixin Duan and Jingqiang Lin
First systematic study of email auto-configuration, where a client fetches server settings from the domain or DNS instead of the user typing them. Ten attack scenarios covering seventeen defects let an attacker steer a…
-
Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications
Qiyi Zhang, Fengyu Liu, Zihan Lin and Yuan Zhang
Studies authentication bypasses caused by disagreement between Java URL routing and access checks. UABScan extracts framework routing features, slices URL-dependent code, and matches risky checks against sanitization…
-
Blind trust: what is hidden behind the process of creating your PDF file?
Aleksey Solovev
An audit of seven HTML-to-PDF libraries showing that attacker-supplied HTML, CSS or SVG crosses a trust boundary inside the renderer: path traversal embeds private server files into the returned PDF, image and…
- Bullseye: Detecting Prototype Pollution in NPM Packages with Proof of Concept Exploits Tariq Houis
-
By Executive Order, We Are Banning Blacklists: Domain-Level RCE in Veeam Backup and Replication (CVE-2025-23120)
Piotr Bazydlo and Sina Kheirkhah
Traces a Veeam .NET Remoting chain through an allowed outer object and denylisted inner deserialization. Product-specific DataSet subclasses inherit dangerous parent behavior while escaping class-name checks; the source…
-
Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS
Piotr Bazydlo
Follows SOAP UsernameToken handling through a custom password callback and attacker-selected authentication modes. An empty-secret digest and a later omitted-password variant bypass Kentico staging authentication under…
-
Bypassing CSP with New Relic Custom Events
Justin Gardner
A goto parameter redirected the POST carrying a victim's login token, and the site's strict policy still permitted New Relic's beacon host. Sending the JSON body to New Relic's event API stored it as an error record…
-
Cache Me If You Can: Sitecore Experience Platform Cache Poisoning to RCE
Piotr Bazydlo
Uses restricted Sitecore reflection to invoke a control’s AddToCache method and poison a server-side rendering cache. Configuration analysis and metadata/count queries recover usable cache keys; a privileged reader can…
-
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting
Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow and Michael Schwarz
Script-less fingerprinting built from modern CSS. Container queries, arithmetic functions and complex selectors leak application, operating system and hardware details even where JavaScript is disabled, separating 97.95…
-
Client Side Path Traversal (CSPT) Bug Bounty Reports and Techniques
Renwa and @RenwaX23
Six bug bounty cases of client-side path traversal: front-end code builds an API path from a URL segment, so backslashes, double-encoded dots or router quirks send the fetch to a different endpoint. Pairing that with an…
-
Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit
Amirmohammad Safari
A client-side path traversal is normally confined to the origin hosting the vulnerable fetch. Chaining it to a gadget that answers with a 307 or 308 redirect, such as an image transformation endpoint, preserves method…
-
CRLF Injection Nested Response Splitting CSP Gadget
Tang Cheuk Hei
A CRLF injection in a response header is nested inside itself: the injected script tag points at a same-origin URL carrying a second response-splitting payload, so a strict script-src self policy is satisfied. Injecting…
-
Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange
Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu and Haixin Duan
HTTP/2 server push and Signed HTTP Exchange authorise content by the certificate's subject alternative names rather than by the URI origin, so where a certificate is shared an off-path attacker can push or sign…
-
Cross-Site WebSocket Hijacking Exploitation in 2025
Laurence Tennant and @includesecurity
Cross-Site WebSocket Hijacking lets a malicious page open an authenticated WebSocket to a server that skips the handshake Origin check, then send and read messages as the victim. Re-tested against current browsers…
-
CSS Data Exfiltration to Steal OAuth Token
Amirmohammad Safari and Yashar Shahinzadeh
Combines an OAuth redirect with CSS injection on a page where an advertising script reflects the URL token into a DOM attribute. Imported styles test that attribute and signal matches through background requests; the…
-
CVE-2025-1974: The IngressNightmare in Kubernetes
Nir Ohfeld, Ronen Shustin, Sagi Tzadik and Hillai Ben-Sasson
Ingress-NGINX's unauthenticated admission controller builds an NGINX config from a submitted Ingress object and injects annotation values unsanitised. Chained with the undocumented ssl_engine directive and a shared…
-
CVE-2025-26788: Passkey Authentication Bypass in StrongKey FIDO Server
Natalia Trojanowska-Korepta
StrongKey FIDO Server fails to distinguish the discoverable from the non-discoverable WebAuthn authentication flow. An attacker begins preauthentication with the victim's username, replaces the returned allowed…
-
Discourse Backup Disclosure: A Rails send_file Quirk
Harsh Jaiswal and Rahul Maini
Explains how client-influenced file-delivery headers crossed the boundary between Rails/Rack and trusted Nginx routing, exposing Discourse backup files. This March 2025 analysis expands a December 2024 disclosure and…
-
Disguises Zip Past Path Traversal
@phaldrzynski and Paweł Hałdrzyński
A schizophrenic ZIP is parsed differently by two readers in the same program. When an application lists entry names with one API and extracts with another, a crafted archive hides a traversing entry from the validator…
-
Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection
Soheil Khodayari, Kai Glauber and Giancarlo Pellegrino
Re-assessment of open redirects, focused on client-side JavaScript redirections. A static and dynamic pipeline mined 184 vulnerability indicators and found 20,800 open redirects across 623 of the top 10,000 sites plus…
-
DOM-based Extension Clickjacking: Your Password Manager Data at Risk
Marek Tóth and @MarekToth
A single click on an attacker's page can make a password manager autofill its stored data into a hidden form: script hides the extension's injected autofill interface by setting opacity, or covers it with a transparent…
-
Eclipse on Next.js: Conditioned exploitation of an intended race-condition
zhero
Next.js deduplicates in-flight requests with a promise batcher keyed only on path and revalidation flag, so two requests that both fall back to the error page share one result. Racing a request whose pageProps body is…
-
EvoCrawl: Exploring Web Application Code and State using Evolutionary Search
Xiangyu Guo, Akshay Kawlay, Eric Liu and David Lie
EvoCrawl crawls web applications using evolutionary search over sequences of interactions, so it satisfies field and format constraints and reaches server states earlier scanners miss: 59 percent more code coverage and…
-
Exploiting The Not So Misuse-Resistant Authenticated Encryption API of OpenSSL
sideni.xyz
OpenSSL-backed AEAD decryption APIs in Ruby, PHP, Node.js, Rust and Erlang take the tag length from whatever tag is supplied, so code that never checks it accepts a one-byte tag, brute-forceable in 256 tries. An…
-
Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
stypr
The mysqljs/mysql escape function encodes values differently per JavaScript type, and an Object becomes backtick-quoted identifiers rather than a quoted string. Passing a parameter as an object through Express turns a…
-
Fontleak: exfiltrating text using CSS and Ligatures
Dragos Albastroiu
An attacker who can inject CSS loads a custom font whose ligature rules collapse a known prefix plus the next character into a single glyph of a distinct width, so a container query on a sibling element measures that…
-
Forcing Quirks Mode with PHP Warnings + CSS Exfiltration without Network Requests
arkark
Overflowing the PHP input-variable limit emits a warning before the doctype, forcing quirks mode, where the same-origin MIME check is relaxed so a 404 page echoing the URL loads as a stylesheet under a self-only policy…
-
Funky chunks – addendum: a few more dirty tricks
Jeppe Bonde Weikop
Extends the chunked-body smuggling family. If one parser blindly skips two bytes as the chunk-body terminator while the other accepts a bare newline, a byte of the next chunk size is consumed and the two disagree on its…
-
Funky chunks: abusing ambiguous chunk line terminators for request smuggling
Jeppe Bonde Weikop
HTTP implementations disagree over what ends a line in a chunked body: some read a bare newline inside a chunk extension as a terminator, others swallow it, and some accept any two bytes after an oversized chunk body…
-
Fuzzing WebSockets for Server-Side Vulnerabilities
aretekzs.com
Extends a Burp scanner to WebSockets by opening a fresh connection per payload, optionally sending prerequisite handshake messages, and capturing every message that arrives in a configurable window. Anomalies are judged…
-
Google Cloud Account Takeover via URL Parsing Confusion
Mohamed Benchikh
Google's OAuth backend and Chrome disagree about URLs carrying two at-signs and IPv6 loopback literals, so a redirect target passes Google's loopback allow-list while the browser navigates to the attacker's host. An…
-
Gotchas in Email Parsing - Lessons From Jakarta Mail
Jia Hao Poh
Maps Jakarta Mail, Spring mail wrappers and Hibernate validation to concrete email-parsing decisions. Constructor and setter examples contrast parsed input with direct assignment, encoded personal names and group…
-
Hacking Gemini: A Multi-Layered Approach
Valentino Massaro
Gemini renders model output through several layers, and its linkifier does not count an exclamation mark as part of a hostname, so injected text can flip a trusted link into a Markdown image. Chained with indirect…
-
How I Accessed 1,800 Company Livestreams and Uncovered a New Web Exploit Class: RRE
Farzan Karimi
Recursive Request Exploits trace a chain of dependent API calls backwards from a sensitive value such as a stream identifier to the first request that introduces it, then abuse the earliest hop that enforces no…
-
how to hack discord, vercel and more with one easy trick
eva.ac
A documentation platform rendered customer pages server side, so an expression in a docs page ran code on its server, exposing environment secrets and a cache shared by every customer. A separate static-asset route also…
-
How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs
Bruno Halltari and Caue Obici
Two authentication flaws found auditing exchanges and wallets. Allow-listing localhost as an OAuth origin lets a malicious mobile app run a local web server and complete sign-in silently to capture the token…
-
HPACK Bombing Apache
Stefan Eissing
Explains how HPACK expansion, repeated-header merging and APR allocation lifetime exhaust Apache HTTP/2 memory despite nominal request limits. Long names with empty values evade accounting while temporary strings remain…
-
HTTP/1.1 must die: the desync endgame
James Kettle
New classes of HTTP desync against upstream HTTP/1.1: detecting parser discrepancies with masked headers, making zero-length desyncs exploitable through early-response gadgets and a double-desync that converts them, and…
-
Impossible XXE in PHP
Aleksandr Zhurnakov
Exploits XXE in PHP code that looks safe: external entity loading off, network access disabled, and DOCTYPE nodes rejected after parsing. Parameter entities expanded while parsing, a system identifier on the DOCTYPE…
-
In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web
Jan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns and Giancarlo Pellegrino
Combines taint tracking and static analysis to find DOM reads that influence script execution, requests, links, and other sensitive operations. Pairs verified gadgets with markup injection points and studies parser…
-
Inline Style Exfiltration: leaking data with chained CSS conditionals
Gareth Heyes
CSS conditional functions inside a style attribute can test an element's own attribute value, and chaining them nested picks a different background image URL per candidate value. An attacker who controls only an inline…
-
MadeYouReset Technical Details - How (and Why) It Works?
Gal Bar Nahum
MadeYouReset makes an HTTP/2 server reset a stream itself, using primitives such as a zero-increment window update or a frame sent after the client closed the stream. The reset frees the concurrency slot at once while…
-
Make Self-XSS Great Again
Slonser
Credentialless iframes share an origin with ordinary iframes, so one page can hold a frame logged into the attacker's account and another in the victim's session and script across them. With login CSRF or clickjacking…
-
Make XXE Attacks Brilliant Again !!!
killer
A Java XXE that swallows every error can still be exploited out of band on Windows: FTP exfiltration is limited to a single line from JDK 8u131 onward and HTTP URLs reject newlines, but file and netdoc URLs aimed at a…
-
MerCuriuzz: Identifying Logical Vulnerabilities in QUIC Implementations
Kaihua Wang
Publishes the MerCuriuzz artifact for testing logical failures in QUIC implementations. The method combines segmented interaction mutation, semantic differences and resource-use oracles to expose CPU, memory and…
-
More Than DoS: Progress Telerik UI for ASP.NET AJAX Unsafe Reflection (CVE-2025-3600)
Piotr Bazydlo
Investigates request-controlled type resolution and no-argument constructors in Telerik UI. The article separates denial-of-service effects from conditional execution paths, then traces a Sitecore chain that initializes…
-
My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers
Yufan You, Jianjun Chen, Qi Wang and Haixin Duan
A differential fuzzer compared 50 ZIP parsers across 19 programming languages and found 14 classes of parsing ambiguity, 10 of them new. One crafted archive is read differently by two programs, letting an attacker slip…
- Network-Level Prompt and Trait Leakage in Local Research Agents Hyejun Jeong, Mohammadreza Teymoorianfard, Abhinav Kumar, Amir Houmansadr and Eugene Bagdasarian
-
New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails
Alex Brown
Unsafe Ruby reflection or Marshal deserialisation in a Rails app becomes remote code execution by constructing a SQLite3 database object whose extensions option loads an attacker-supplied shared library. The file is…
-
NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities
Darion Cassel, Nuno Sabino, Min-Chien Hsu, Ruben Martins and Limin Jia
NodeMedic-FINE pairs a type and object-structure aware fuzzer with dynamic taint tracking over npm packages, then uses the taint information to synthesise proof-of-concept exploits for arbitrary code execution and…
-
Nonce CSP bypass using Disk Cache
Jorian Woltjer
Turns an HTML injection into XSS under a nonce-based policy. CSS injection leaks the nonce from the meta policy tag, then forcing a fall back to disk cache replays the page with its old nonce while login CSRF and cache…
-
Novel SQL Injection Technique in PDO Prepared Statements
Adam Kues and @searchlightsec
PDO emulates prepared statements by default and parses the SQL with its own scanner. A null byte makes that scanner abandon a backtick-quoted identifier, so an attacker's question mark inside a column name becomes a…
- One Email, Many Faces: A Deep Dive into Identity Confusion in Email Aliases Mengying Wu, Geng Hong, Jiatao Chen, Baojun Liu, Mingxuan Liu and Min Yang
-
Opossum Attack
Robert Merget, Nurullah Erinola, Marcel Maehren, Lukas Knittel, Sven Hebrok, Marcus Brinkmann, Juraj Somorovsky and Jörg Schwenk
Cross-protocol desynchronisation against services that offer both implicit TLS on a dedicated port and opportunistic TLS upgrade. A man-in-the-middle splices the client's TLS connection onto its own upgraded plaintext…
-
PANGOLIN: Fuzzing Multilingual IoT Firmware with LLM-Driven Code Analysis
Zhipeng Jia, Xiaokang Yin, Shuitao Gan, Chao Zhang, Hangtian Liu, Jiangan Ji, Enzhou Song, Ruijie Cai, Jinglei Tan and Shengli Liu
Original December 2025 artifact for multilingual IoT firmware fuzzing. It combines handler and parameter recovery across languages, LLM-assisted constraint extraction, structured input generation and response feedback…
-
Permission Hijacking at Scale
Alberto Fernandez-de-Retana
Permissions delegated to an iframe cannot be revoked by the host page, prompts name the top-level origin rather than the frame, and delegated grants never re-prompt. Compromising one widely embedded support-chat vendor…
-
PermissionJacking: How a Subtle Bug in Safari Could Lead to Camera Hijacking
RenwaX23
Safari on macOS leaves camera, microphone and location prompts clickable while the window is unfocused, so one click reaches Allow. Two clickjacking methods hide the prompt under a pop-up: one flickers the pop-up size…
-
Perplexity Comet UXSS
s1r1us and sudi
Studies Comet’s trust in a vendor origin: an XSS there could reach privileged browser-extension capabilities and agent task interfaces across website origins. The account separates those direct browser-authority paths…
-
Phishing Attacks against Password Manager Browser Extensions
Claudio Anliker, Daniele Lain and Srdjan Capkun
Password manager extension popups are painted over the page viewport and look no different from page content, so a site the attacker controls can render a convincing replica of a locked password manager and capture the…
-
Posthammer: Pervasive Browser-based Rowhammer Attacks with Postponed Refresh Commands
Finn de Ridder, Patrick Jattke and Kaveh Razavi
A Rowhammer attack written in JavaScript that alternates bursts of intense hammering with long idle windows, so the memory controller postpones and batches the refresh commands that would otherwise trigger in-memory…
-
Prepared Statements? Prepared to Be Vulnerable.
Balazs Bucsay
The Node.js mysql and mysql2 drivers convert JavaScript objects and arrays into SQL fragments by default, so submitting a JSON object where a string is expected turns a correctly parameterised prepared statement into…
-
Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks
Rein Daelman
CI workflows paste untrusted issue, pull-request and commit text straight into prompts for AI agents that hold write-scoped tokens and shell tools. A crafted issue body is read as instructions, so the agent uses its own…
-
Puny-Code, 0-Click Account Takeover
Yashar Shahinzadeh and Amirmohammad Safari
Explains how database collation can equate distinct email spellings while message delivery preserves their difference. Reset and OAuth examples map the wrong identity to a victim account; SQL probes, a safe WordPress…
-
Pwning OpenAI Atlas Through Exposed Browser Internals
s1r1us and sudi
Analyzes exposed browser internals in OpenAI Atlas, combining vendor-origin XSS and login CSRF with privileged Mojo interfaces. Demonstrated tab-URL disclosure can expose authorization codes in susceptible flows; the…
-
Python Dirty Arbitrary File Write to RCE via Writing Shared Object Files Or Overwriting Bytecode Files
siunam
Two ways to turn a restricted arbitrary file write into code execution in Python web applications. Overwriting a cached bytecode file works when the magic number, source timestamp and size are preserved or brute-forced…
-
RaceDB: Detecting Request Race Vulnerabilities in Database-Backed Web Applications
An Chen, Yonghwi Kwon and Kyu Hyung Lee
RaceDB finds request race conditions in PHP database-backed applications by tracking data dependencies through the application code as well as the SQL, building a race graph, then replaying candidate request pairs both…
-
Racing and Fuzzing HTTP/3: Open-sourcing QuicDraw(H3)
Maor Abutbul
Adapts the single-packet race-condition attack to HTTP/3: because QUIC forbids IP fragmentation, every request is queued minus its final byte and all the withheld last bytes are released together in one packet, so the…
-
React2Shell: JavaScript's Long-Awaited Deserialization Flight-mare (CVE-2025-55182)
Lachlan Davidson
The finder's page for React2Shell, an unauthenticated remote code execution flaw in server-side React reached through Server Component endpoints and tracked separately for Next.js because Next.js vendors React. It gives…
-
RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox
Xiang Li, Mingming Zhang, Zuyao Xu, Fasheng Miao, Yuqi Qiu, Baojun Liu, Jia Zhang, Xiaofeng Zheng, Haixin Duan, Zheli Liu, Yunhai Zhang and Dunqiu Fan
Studies how distinct EDNS Client Subnet values prevent DNS query aggregation while replies omitting that option create additional spoofed-response matches. Controlled resolver experiments and deployment measurements…
-
ReDisclosure: New technique for exploiting Full-Text Search in MySQL (myBB case study)
Exploit Azerbaijan
MySQL boolean-mode full-text search operators form a matching language that escaping, prepared statements and scanner rules do not treat as injection. Smuggling them into a full-text search turns the…
-
Ruby Array Pack Bleed
Luke Jahnke
A signed and unsigned mismatch in the repeat-count parsing of Ruby's Array pack makes a huge count negative, so the back-up-a-byte directive grows the packed string instead of shrinking it. The result discloses heap…
-
SAML roulette: the hacker always wins
Gareth Heyes and Zakhar Fedotkin
Ruby-SAML validates with one XML parser and reads attributes with another, so a round-trip mutation in a system identifier, and namespace confusion built from duplicate declarations the first parser wrongly permits…
-
SharePoint ToolShell – One Request PreAuth RCE chain CVE-2025-53770
@_l0gg and khoadha
A one-request pre-auth remote code execution chain in SharePoint: a Referer of the SignOut page skips the anonymous-access check, and ToolPane.aspx parses attacker-supplied control markup before the form-digest check. A…
-
Stealing oAuth Token via Referrer Policy Override
Omid Rezaei
Turns a limited image injection into OAuth-code leakage by controlling the image response. A Link preload header specifies unsafe-url referrer policy, causing the documented Chrome behavior to disclose the embedding…
-
STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers using Session Tickets
Sven Hebrok, Tim Leonhard Storm, Felix Matthias Cramer, Maximilian Radoy and Juraj Somorovsky
Web servers that share one TLS session ticket encryption key across their virtual hosts let a ticket issued by one host be resumed against another, confusing which host and which client a session belongs to. That…
-
Stopping Redirects
Jorian Woltjer
Ways to cancel or pause a browser redirect: unredirectable protocols, dangling-markup URL blocking, overlong URLs and cookie bombing that force error pages, WAF triggering, the navigation rate limit, and sandboxing a…
-
Styled to Steal: The Overlooked Attack Surface in Email Clients
Leon Trampert, Daniel Weber, Christian Rossow and Michael Schwarz
Injecting standard CSS into an encrypted email lets an attacker read its decrypted text: attacker-crafted font ligatures give the plaintext a content-dependent width, container queries measure that width, and each width…
-
SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase
s1r1us, rootxharsh, zayne and LiveOverflow
Investigates Supabase database privilege boundaries, showing how event-trigger callbacks and missing ownership checks interacted with temporary elevated roles. The complete chain applied to deprecated infrastructure…
-
SVG Filters - Clickjacking 2.0
rebane2001
SVG filters still apply to cross-origin iframes, and tiling, blending and compositing primitives can crop single pixels of the framed page and combine them into logic gates. An overlay can then read the framed…
-
Temenos OFS Field Injection: Revealing a Hidden Financial Attack Vector
Omar Elshopky (3l5h0pky)
An instant payment API concatenated user input straight into Temenos T24 OFS command strings, so a comma lets an attacker append extra fields to the funds-transfer request. Overriding the debit account number takes the…
-
The Fragile Lock: Novel Bypasses For SAML Authentication
Zakhar Fedotkin
Parser inconsistencies between REXML, Nokogiri and libxml2 let an attacker forge SAML responses: attribute pollution, namespace confusion via the reserved xml prefix, and a canonicalisation failure that makes the digest…
-
The minefield between syntaxes: exploiting syntax confusion
Alex Brumen
Parsers in one stack accept different syntaxes for the same value: Python and Perl named unicode escapes, Content-Disposition filename versus filename*, file URIs carrying a host, and PHP parse_url ports with leading…
-
The Power to Never Be Wrong: Evasions and Anachronistic Attacks Against Web Archives
Robin Kirchner, Chris Tsoukaladelis, Martin Johns and Nick Nikiforakis
Studies eight web archives using instrumented pages and crawler metadata. It shows how CSP or script stripping and server-side cloaking distort captured content, while future archive references and live-web escapes let…
-
The Quiet Side Channel... Smuggling with CL.0 for C2
d3d (M. B. Johnson)
Shows how a CL.0 request-smuggling desync against CDN-fronted sites can poison the shared cache so a chosen string is stored in a 3xx Location redirect header. Reading and writing encoded data through that poisoned…
-
The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling
Thomas Stacey and @AssuredAB
HTTP/2 to HTTP/1.1 downgrade request tunnelling is widely dismissed as a smuggling false positive; sending a deliberately invalid tunnelled request exposes it, and firing a group of requests as a single packet turns a…
-
The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance
Mehmet Ince and @mdisec
Chains six weaknesses in the LogPoint SIEM appliance into unauthenticated remote code execution: proxy path routing that exposes internal endpoints, a hard-coded token signing secret, leaked credentials for a hidden…
-
Trailing Danger: exploring HTTP Trailer parsing discrepancies
Sebastiano Sartor, Sebastiano Sartor - sebsrt and @s3bsrt
Audits around 70 HTTP implementations for how they handle chunked trailer fields and shows that merging trailers into the header section, or validating them loosely, lets an attacker inject headers the front-end never…
- TranSPArent: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction Senapati Diwangkara and Yinzhi Cao
-
Under the Beamer
kevin_mizu
DOM clobbering gadget in a widget library. Because named items of an HTML collection are not writable, injected elements sharing an identifier stop the library assigning its own escaping function; a second gadget…
-
Unexpected security footguns in Go's parsers
The Trail of Bits Blog
Go's JSON, XML and YAML parsers are surprisingly lenient: a dash struct tag with omitempty leaves the field settable, JSON matching is case-insensitive and keeps the last duplicate key, and the XML parser accepts…
-
Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms
Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau and Julien Lecomte
Integration platforms such as workflow automation tools and smart homes link user accounts to third-party apps over OAuth without telling the apps apart, so authorization granted to one app reaches another. A hostile…
-
Vault Raider: Stealthy UI-based Attacks Against Password Managers in Desktop Environments
Andrea Infantino, Mir Masood Ali, Kostas Solomos and Jason Polakis
Compares password-manager autofill and credential-copy interfaces across desktop environments. Original code illustrates how alternate UI paths can weaken application-identity checks, with explicit unlocked-vault and…
-
Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains
Nick Copi
Vega's sandboxed expression language forbids arbitrary function calls, but an object whose toString is set to a library method has that method invoked on coercion. Because the method calls one of its own properties with…
-
VESTA Admin Takeover by exploiting bash $RANDOM limitations
Adrian Tiron and @adrian__t
Bash seeds its random variable by XORing microseconds and the process id into the timestamp without any bit shift, so only the low 20 bits vary and the seed lies within about a 12-day window of install time. Vesta…
- Windsurf: DNS rebinding against a local AI coding service s1r1us