PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top web hacking techniques of 2024, McDelivery hijack, 4D SOTA jailbreak – ethical hacker news roundup

yeswehack.com | research | #bug-bounty | #api-security | #jailbreak | #research | #portswigger | #web-hacking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Roundup: PortSwigger's top 10 web hacking techniques of 2024 (including a YesWeHack hunter's research), a McDelivery API hijack, a 4D jailbreak of a new open-source SOTA model, and more.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
Top 10 web hacking techniques of 2025: call for nominations
PortSwigger opens nominations for its Top 10 Web Hacking Techniques of 2025, seeking novel, reusable research. Community votes and an expert panel select the final ten, published February 3.
research · portswigger.net
Cracking the lens: targeting HTTP's hidden attack-surface
James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · theori.io
DeepSeek Security, Privacy, and Governance: Hidden Risks in Open-Source AI
An assessment of DeepSeek R1’s security and privacy risks — easy jailbreaks, higher rates of harmful output and insecure code, an exposed ClickHouse database — plus advice for users and developers.
Back