@t0xodile.com.bsky.social
Penetration tester trying to perform novel research. You can find all of my write-ups and research at https://thomas.stacey.se.
That is coming eventually but only just started on it really π. This is more βswiggeryβ
08.08.2025 20:24 β π 0 π 0 π¬ 0 π 0Something like that π!
08.08.2025 15:14 β π 1 π 0 π¬ 1 π 0
The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com
06.08.2025 23:43 β π 38 π 20 π¬ 0 π 2Itβs Defcon travel day today! Mega excited for an enormous number of reasons. If all goes well, many of them will become apparent roughly two weeks after it all endsβ¦
06.08.2025 07:39 β π 1 π 0 π¬ 1 π 0I imagine smashing the state machine was pretty rough for that π ?
30.07.2025 11:11 β π 0 π 0 π¬ 1 π 0I've gotten so lost in working on detection techniques that I've forgotten about a few very valid looking cases I found with the initial probe. π Good news is, the tool looks like it might actually be useful regardless of what happens. But I guess I should focus on getting some exploits...
30.07.2025 07:03 β π 3 π 0 π¬ 1 π 0
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! π₯
The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs π
gmsgadget.com
1/4
Not yet sure on how API access works yet, but a new online subdomain lookup service has arrived. subintel.tushal.io, seems pretty great!
24.07.2025 06:53 β π 0 π 0 π¬ 0 π 0Faaaantastic! π₯
23.07.2025 14:59 β π 1 π 0 π¬ 0 π 0Everything I do leads me back to param-miner π. What a tool βοΈ
23.07.2025 07:46 β π 1 π 0 π¬ 0 π 0This is pretty cool. Things start getting really confusing when you look into the chunk extensions so... this is a huge help!
22.07.2025 14:00 β π 2 π 1 π¬ 0 π 0This has GOT to be as sticker?!
18.07.2025 13:01 β π 2 π 0 π¬ 1 π 0You're not ready for how powerful Custom Actions are.
You can now build your own AI hacking sidekicks that rewrite requests for you.
Forget typing payloads - just let your assistant do it.
π₯ Welcome to the future of offensive automation.
Get the source code:
github.com/PortSwigger/...
What on earth is this wizardry π§!
17.07.2025 13:57 β π 0 π 0 π¬ 1 π 0
New blog post is up: How I leaked the IP addresses of Brave's Tor window and Chrome VPN extension users--plus, a new Popunder technique and connect-src CSP directive bypass. Read more @ 0x999.net/blog/leaking...
16.07.2025 11:00 β π 5 π 5 π¬ 0 π 0Manual testing doesn't have to be repetitive.
Meet Repeater Strike - an AI-powered Burp Suite extension that turns your Repeater traffic into a scan check.
Source code:
github.com/hackvertor/r...
Blog post:
portswigger.net/research/rep...
Submitted a second case based on the same research lead, this time using a technique I've not personally seen before to achieve a desync and a completely accidental exploit chain to achieve impact. Should make for a fun story even if this lead doesn't continue to produce results π₯
14.07.2025 07:40 β π 2 π 0 π¬ 0 π 0This feels like a possible T-Shirt using the "I reported X and all I got was this lousy X" template.
11.07.2025 12:27 β π 1 π 0 π¬ 0 π 0
π§ CORS misconfigurations are sneaky. Want to catch them with static analysis?
Kevin Stubbings from GitHub Security Lab shows how to model CORS middleware in CodeQLβusing Goβs Gin framework as a case study.
Great insights for researchers & devs:
github.blog/security/app...
π₯ Want to think like a hacker and truly understand JavaScript?
π» JavaScript for Hackers is your guide to breaking, bending, and mastering the language like never before.
Close enough! AMA: docs.google.com/forms/d/e/1F...
I'll do a live stream answering questions some time soon :)
I noticed in my latest post that a lot of the initial traffic was mobile. And later on itβs been desktop and others. Thank god someone told me to check the mobile view for all the markdown code π
07.07.2025 15:17 β π 0 π 0 π¬ 0 π 0Gooood to know π thanks!
07.07.2025 12:08 β π 1 π 0 π¬ 0 π 0Did you add this in because of your research? π€ just came across it in the wild.
05.07.2025 19:38 β π 1 π 0 π¬ 1 π 0
Here's my writeup the technique allowing some nonce-based CSPs to be bypassed. I think it definitely has some practical use, so included some details about different scenario's.
Don't let that HTML-injection of yours wait!
jorianwoltjer.com/blog/p/resea...
New video! Getting Into Cybersecurity - An Interview with James Kettle!
In this episode, James Kettle talks about how he got started in security research, and how you can pivot into this rare but worthwhile role.
Watch now: youtu.be/S64Eq0Y3SrY
Listen on Spotify: open.spotify.com/show/5m5711J...
Interested in pushing hacking techniques beyond the state of the art, or breaking into full-time security research? I recently had a great chat with Tib3rius on the topic! Watch it here:
www.youtube.com/watch?v=S64E...
Nginx normalizes paths (/../, %2e, etc.) before applying access rules like: location = /admin { deny all; }
But backends like Node.js or PHP handle decoding again, and differently.
Building detection techniques is an underrated part of research for me. I imagine working on solid detection code for a DAST scanner would be fun. Today I made a small change based on a particularly sensitive header and suddenly a bunch of new cases popped up in, critically, a different tech stack.
27.06.2025 08:03 β π 4 π 0 π¬ 0 π 0
Thrilled to announce: Iβll be presenting a major new version of WebSocket Turbo Intruder at Black Hat Arsenal 2025! This open-source toolkit makes high-speed, advanced WebSocket attacks practical and painless.
26.06.2025 13:56 β π 9 π 3 π¬ 1 π 0
