PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The latest PortSwigger research is coming to Black Hat Europe 2020

portswigger.net | blog | #conference | #xss | #research | #portswigger-research | #black-hat-europe | #pdf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PortSwigger brings its latest research to the digital Black Hat Europe 2020, with Gareth Heyes presenting XSS attacks against PDFs and James Kettle joining the conference locknote.
Published
Collected

Related coverage

research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
research · yokai.hakaisecurity.io
SQL Injection and XSS Vulnerability on Centreon
I’m Daniel França Lima and i’m a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and network asset monitoring solution based […]
blog · portswigger.net
Try it for yourself: the latest PortSwigger Research from Black Hat USA
At Black Hat USA, PortSwigger Research debuted practical web timing attack techniques by James Kettle, now in Param Miner, plus email parsing discrepancy research and new training labs.
blog · portswigger.net
DOM Invader and the case of direct eval vs indirect eval
Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.
blog · portswigger.net
New techniques and tools for web race conditions
James Kettle's Black Hat and DEF CON talk introduces new web race condition classes beyond limit-overrun, plus the single-packet attack that sends parallel requests within 1ms, now in Burp Repeater.
blog · blog.trailofbits.com
PDF is Broken: a justCTF Challenge
Trail of Bits engineers crafted a justCTF challenge exploiting PDF format quirks: a Ruby/PDF polyglot that runs as a script while rendering as a blank page, teaching steganography and forensic tricks.
Back