PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Backslash Powered Scanning: hunting unknown vulnerability classes

portswigger.net | vulnerability | #burp-suite | #vulnerability-research | #fuzzing | #injection | #scanner | #backslash-powered-scanning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle presents backslash-powered scanning: an approach that finds known and unknown classes of server-side injection flaws with a tiny network footprint, tested across thousands of sites.
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
Critical · vulnerability · bishopfox.com
Fortinet FortiWeb Authentication Bypass – CVE-2025-64446
Bishop Fox confirms CVE-2025-64446: one HTTP POST with a path traversal and crafted header creates an admin account on vulnerable FortiWeb builds, giving device takeover; CISA KEV listed.
vulnerability · bishopfox.com
What Is XSS?: An Overview
An explainer on cross-site scripting: how XSS runs attacker code in victims' browsers, the reflected, stored, and DOM-based varieties, and why contextual output encoding is the core defense.
vulnerability · bishopfox.com
How to Prevent the OWASP Top 10
Prevention guidance for the 2017 OWASP Top 10 — injection, broken authentication, sensitive data exposure, XSS, and more — with concrete fixes for each risk class.
vulnerability · hackerone.com
Vulnerability Prioritization: Severity Does Not Mean Priority
Severity alone doesn't set remediation priority: correlating externally discovered hacker findings with noisy scanner output gives AppSec teams a data-informed way to cut through alert fatigue.
Back