Soroush Dalili 🍏🍐

Some sites may use direct IP address today if their domain name servers were not with Cloudflare too! There is this opportunity for WAF bypass... please share it , sharing is caring... 🤗

happy cloudflare outage day to all who celebrate

With cloudflare being down, and as a result, most things I use being down, I came here to say hi 🤭 I guess I will use other AIs than chatgpt today!

Wouldn't this also be vulnerable to dns rebinding attacks?

I only have one ticket! I am not the worst 🤣

You would have kept it if it was called activity logs 🥹 Probably an ego boost would be a better name for these activities though 🥲

These days, I’m off work, busy taking care of a family member, so this really brightened my day and brought a big smile to my face. 😌 thanks @portswigger.net

I wonder if burp itself can do something for jython extensions since it has access to the location of a jython jar file to share it with extensions. But even with that I need to see how jython can use montoya 🥲

Do we need to include the jython jar file in it? forum.portswigger.net/thread/are-j...

I always thought jython cannot use montoya. Is this a hackvertor hack or it's been always possible?

DC4420 - April 2025 A beta relaunch of the calendar classic DC4420.

Did you know? DC4420, the London monthly that graced central London for all of the 10s and before, has a new home and a new date!

Greene Man, 383 Euston Road, London, NW1 3AU
April 29

Be there.

www.eventbrite.co.uk/e/dc4420-apr... has details. you don't have to register.

#infosec #security

If you like hacking XML, this article is a gold mine! 😱

It includes parser discrepancies, round-trip attacks and my favorite, namespace confusion 🤩

As always, also thanks to @albinowax and @PortSwigger for keeping the top 10 flame alive for another year!

Congrats to all the winners (especially @orange.tw) and all researchers who made the 2024 long list! 🥂 Thanks for sharing your work with us! 🫡

To readers: Don’t just read the top 10—start there and then explore the rest. There are many great works beyond the top 10, so don’t limit yourself! 🦾

This year two new security legends have joined the top-ten expert panel - @liveoverflow.bsky.social and @stokfredrik.bsky.social! Excited to see what analysis & insights they bring to the top ten alongside long-time contributors @agarri.fr and @irsdl.bsky.social

Top 10 web hacking techniques of 2024 Welcome to the community vote for the Top 10 Web Hacking Techniques of 2024.

Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here: portswigger.net/polls/top-10...

Please submit any interesting and especially new web/http related topic published in 2024

You are right. Unfortunately it's a cruel one especially when there is no sponsor. Most researchers also just use it with not much contribution which is ok but sad.

If you are using YSoSerial .Net, we have accepted a few PRs and patched several bugs & improved the ViewState plugin!

Merry Christmas 🎅

github.com/pwntester/ys...

We are extending our call for papers to January 1, 2025!

We are now targeting an end of January release.

If you have any Linux/ELF related research, projects, or papers, we would love to publish them!

Huge thank you to everyone who has already submitted!

tmpout.sh/blog/vol4-cf...

Bsides Birmingham

It seems Bsides Birmingham is now happening:
www.bsidesbrum.com

CFP is also open! 😎

Currently at #BSidesLDN2024

@n1ckdunn.bsky.social

Securi-Tay 2024 The thirteenth annual occurrence of the Securi-Tay conference! Brought to you by @AbertayHackers.

🔥 Get ready for the biggest #SecuriTay yet! 🔥

🦄 500 attendees
🎮 2-day CTF
🤝 Multiple sponsors

📅 Happening 28 | 02 | 2025 - First ticket drop coming soon! 👀

More details at securi-tay.co.uk

Extended the starter with shy writers! 😀 If you're not on the list but write about web security, then feel free to reply with the article you're most proud of, and I will add you to the pack!

Make sure to resubscribe to not not miss on the amazing 🌐research!

go.bsky.app/9JXnB17

📌

I've released 'brainstorm': an alternative way to do web fuzzing combining my fav fuzzing tool 'ffuf' (from @joohoi.bsky.social )with local LLMs (via Ollama API) to generate smarter filename tests. It usually finds more endpoints with fewer requests. Added a IIS shortname support @irsdl.bsky.social

Bug bounty hunters & content creators Join the conversation

The "bug bounty hunters and content creators" starter pack is now up to 60 users! Follow this to get instantly connected to the bug bounty community & let me know if I've missed you off!

go.bsky.app/GD7hKPX

bsky.app/profile/dino... he does bb too :)

📌

Any bug bounty people around? I'm creating a starter pack of people to follow but it's pretty brief currently! Let me know if you'd like to be added: go.bsky.app/GD7hKPX