Top 10 Web Hacking Techniques

2019

The 2019 Top 10 Web Hacking Techniques: 10 Top 10 selections, 40 other nominations and 44 later archive additions, each with its researcher, summary and…

94 records · 10 in the top ten · 40 other nominations · 44 later additions · open this year in the interactive archive

The top ten

1. #1 Cached and Confused: Web Cache Deception in the Wild Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda and William Robertson

   Web cache deception exploits path confusion: a URL such as /account.php/nonexistent.jpg looks static to a caching proxy but resolves to a private page at the origin, so the cache stores it for any attacker to fetch. A…

2. #2 Cross-Site Leaks @sirdarckcat

   The browser HTTP cache answers cross-site questions: evict a resource with a POST or an overlong Referer, make the victim load a target page, then re-probe to see whether it got cached. That reveals whether the page…

3. #3 Owning The Clout Through Server Side Request Forgery Ben Sadeghipour and Cody Brocious

   Server-side HTML to PDF generators render attacker markup in the server's own context, so an injected iframe or an escape from a style tag turns the export feature into server-side request forgery that reaches cloud…

4. #4 Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE! Orange Tsai

   Jenkins validated pipeline scripts by handing them to the Groovy parser, but Groovy compile-time meta-programming executes code while parsing. An unauthenticated attacker uses @GrabResolver and @Grab so Grape fetches a…

5. #5 Google Search XSS LiveOverflow

   Explains how a Google Search XSS was found: fuzzing pairs of HTML tags through different parsing paths and diffing what a sandboxed iframe, DOMParser and createHTMLDocument produce, which exposes noscript and noembed…

6. #6 All is XSS that comes to the .NET @phaldrzynski and Paweł Hałdrzyński

   ASP.NET still accepts a cookieless session segment such as (A(...)) anywhere in a URL path, and Control.ResolveUrl copies that attacker-controlled segment into every app-root-relative URL it emits. Injecting a quote and…

7. #7 Exploring Continuous Integration Services as a Bug Bounty Hunter EdOverflow, Justin Gardner and Corben Leo

   Public continuous-integration build logs on Travis CI, Circle CI and GitLab CI expose secrets belonging to bug bounty targets and their organisation members. The authors automated pulling logs through the vendor APIs…

8. #8 Infiltrating Corporate Intranet Like NSA: Pre-Auth RCE On Leading SSL VPNs Orange Tsai and Meh Chang

   Pre-auth remote code execution chains against Fortigate and Pulse Secure SSL VPNs: traversal file reads, a heap overflow in the web proxy, an undocumented password-reset key, and command injection through a flaw in…

9. #9 Microsoft Edge (Chromium) - Elevation of Privilege to Potential RCE @qab

   Chromium Edge's new tab page is a remote MSN page holding privileged chrome APIs, and unsanitised top-site titles gave script execution inside it. Calling the undocumented chrome.qbox.navigate with a null url crashed…

10. #10 Exploiting Null Byte Buffer Overflow for a $40,000 bounty Sam Curry and @samwcyo

    A registration form passed a user string and its length to a back-end C routine; null bytes were stripped in transit but the length was not, so the C side read past the shortened string. Repeating a POST full of %00…

Other nominations

• A Tale of Exploitation in Spreadsheet File Conversions Brett Buerhaus, Cody Brocious, Sam Erb and Olivier Beg

  Server-side document conversion with LibreOffice is fingerprinted through spreadsheet INFO functions and PDF metadata, then abused because LibreOffice picks the format from file contents, not the extension. An ODS or…

• Abusing autoresponders and email bounces Inti De Ceukelaire

  Autoresponders and delivery bounces return the attacker's own message together with internal details. Filling a Google Drive owner's mailbox made the access-request mail, sent from the attacker's address, bounce back…

• Abusing HTTP hop-by-hop request headers

  Naming arbitrary headers in the HTTP Connection header marks them hop-by-hop, and proxies that forward that list instead of consuming it let an attacker delete headers a downstream hop added. Removing X-Forwarded-For…

• Apache Solr Injection Research Michael Stepankin

  Apache Solr parameter injection: an application that pastes unencoded user input into its Solr query lets an attacker smuggle extra parameters such as shards, qt and stream.body, or Solr local parameters like an…

• At Home Among Strangers Bo0oM

  Reverse proxies normally append the real client address to X-Forwarded-For, making a spoofed value harmless. A bare carriage return can make some back ends stop parsing before the proxy-appended addresses and trust the…

• Backchannel Leaks on Strict Content-Security Policy Mazin Ahmed and @mazen160

  Under a strict default-src 'self' policy the browser still allows outbound requests to unapproved hosts. Chrome does not enforce CSP on link rel=prerender, and Chrome, Firefox and Safari all follow a meta…

• Bypassing SOP Using the Browser Cache Aleksei Tiurin

  The browser cache is keyed only on the absolute URL, with no record of which origin requested it. A JSONP or CORS response cached after a legitimate same-site request is handed back to any site that requests the same…

• Common Security Issues in Financially-Oriented Web Applications Soroush Dalili

  An NCC Group guideline cataloguing business-logic flaws specific to e-commerce and financial web applications: TOCTOU and race conditions on balance checks, parameter and currency manipulation, rounding and numeric…

• CPDoS: Cache Poisoned Denial of Service Hoai Viet Nguyen, Luigi Lo Iacono and Hannes Federrath

  CPDoS poisons a cache with an error page instead of content: a single request carrying an oversized header, a meta character or a method-override header passes the cache but makes the origin fail. The cache stores the…

• DOMPurify 2.0.0 bypass using mutation XSS securitum

  A Chrome and Safari parsing quirk re-serializes markup so content nested inside an svg element jumps out of it when innerHTML is assigned to itself. Markup that DOMPurify judges harmless on first parse therefore mutates…

• Don't open that XML: XXE to RCE in XML plugins for VS Code, Eclipse, Theia, ... thezero and zi0black

  The LSP4XML language server parses XML as soon as an editor opens or saves it, so a malicious file triggers an external entity fetch with no further user action. Its DTD cache then writes the downloaded file to a path…

• ESI Injection Part 2: Abusing specific implementations Philippe Arteau

  Three vendor-specific abuses of injected Edge Side Include tags: an inline fragment writes a fetchable poisoned page into the cache, a remote stylesheet on an include reaches a Java XSLT engine and runs commands, and a…

• Exploiting Deserialisation in ASP.NET via ViewState Soroush Dalili

  ASP.NET signs and encrypts the __VIEWSTATE parameter using machineKey values, so when MAC validation is disabled or the validation and decryption keys leak, an attacker forges a ViewState carrying a serialisation gadget…

• Exploiting JNDI Injections in Java Veracode

  Java 8u191 stopped JNDI lookups loading remote classes, but a malicious RMI or LDAP server can still return a reference naming Tomcat's BeanFactory as its object factory. BeanFactory builds any bean and its forceString…

• Exploiting padding oracles with fixed IVs Teddy Katz’s Blog

  A session token is encrypted with AES-CBC but never signed and uses a fixed IV, so a padding oracle can forge chosen plaintext apart from one uncontrollable random block. Reusing the leading blocks of a freely issued…

• Exploiting prototype pollution - RCE in Kibana @SecurityMB

  Turns prototype pollution into remote code execution in Kibana. A Timelion expression that assigns through an object's prototype pollutes Object.prototype, and Kibana's Canvas then spawns a node child process whose…

• Exploiting Spring Boot Actuators Michael Stepankin

  Spring Boot actuator endpoints left unauthenticated are turned into remote code execution. The jolokia endpoint reloads a Logback config from an attacker URL that performs a JNDI lookup, and the env endpoint rewrites…

• Exploiting SSRF in AWS Elastic Beanstalk Sunil Yadav

  An SSRF in an app hosted on AWS Elastic Beanstalk reaches the instance metadata service and steals the default aws-elasticbeanstalk-ec2-role credentials. The default policy permits listing and writing any…

• Facebook Messenger server random memory exposure through corrupted GIF Dzmitry

  A malformed GIF declared a canvas but omitted image data, causing Facebook Messenger’s server-side renderer to fill the output with uninitialized memory. Repeated uploads produced different images containing fragments…

• Finding and Exploiting .NET Remoting over HTTP using Deserialisation Soroush Dalili

  Servers exposing .NET Remoting over HTTP with TypeFilterLevel set to Full deserialise attacker-supplied SOAP bodies, so ysoserial.net gadgets reach code execution once the Body tags are stripped or a dummy method tag is…

• Get pwned by scanning QR Code Nikhil Mittal

  Firefox for iOS executed javascript URIs supplied by its built-in QR code scanner, so scanning a crafted code ran script in the context of the page the user was already viewing and could read its contents and cookies…

• Getting Shell with XAMLX Files Soroush Dalili

  Uploading a .XAMLX workflow-service file to an IIS application runs code, either through XAML deserialisation gadgets wrapped in an Array element at compile time or through inline C# and expression activities evaluated…

• HostSplit: Exploitable Antipatterns in Unicode Normalization Jonathan Birch

  Some Unicode characters normalise under NFKC to ASCII with URL syntax meaning, so a hostname validated as a subdomain of a trusted site resolves as a different host plus a path, bypassing allow-lists and stealing OAuth…

• HTTP Desync Attacks: Request Smuggling Reborn James Kettle

  Revives HTTP request smuggling by making front-end and back-end servers disagree about where a request ends, using conflicting Content-Length and Transfer-Encoding headers hidden by parser quirks. Timing-based detection…

• IIS Application vs. Folder Detection During Blackbox Testing Soroush Dalili

  Requesting a built-in ASP.NET service endpoint such as profile_json_appservice.axd/jsdebug under any path reveals whether that path is an IIS application, which answers with 200 and JavaScript, or merely a folder, which…

• Let's Make Windows Defender Angry: Antivirus can be an oracle! Ryo Ichikawa

  AVOracle turns Windows Defender into a content-dependent side channel by placing attacker-controlled script fragments around a secret and observing whether the resulting file is flagged. It recovers secrets byte by byte…

• PHP-FPM RCE(CVE-2019-11043) Orange Tsai

  A newline in the URI makes nginx pass an empty PATH_INFO to PHP-FPM, so a pointer calculation underflows and writes a null byte before the buffer, corrupting the FastCGI environment allocator. A following putenv then…

• Remote Code Execution via Insecure Deserialization in Telerik UI Caleb Gross

  Telerik UI for ASP.NET AJAX takes the object type from its encrypted rauPostData upload parameter and hands it to JavaScriptSerializer. After breaking the hard-coded upload encryption key and uploading a mixed mode…

• Reusing Cookies Ricardo Iramar dos Santos

  SaaS vendors that let customers point a subdomain at them by CNAME often share one session cookie across the vendor domain and every customer domain. An attacker signs up for a trial and retargets his own cookie Domain…

• Reverse proxies & Inconsistency Aleksei "GreenDog" Tiurin

  Reverse proxies, caches, and origin servers decode and normalize paths differently, especially around path parameters, encoded dot segments, and duplicate slashes. The slides use these parser differentials to bypass…

• Security analysis of portal element @SecurityMB

  Security review of Chrome's new portal element, which embeds a page that behaves like a top-level frame. It accepted file, chrome and javascript URLs for cross-origin script execution, ignored X-Frame-Options, allowed…

• SSO Wars: The Token Menace Oleksandr Mirosh and Alvaro Muñoz

  Two flaws in .NET single sign-on. An unvalidated algorithm name from a JWT header or an XML SignatureMethod reaches CryptoConfig, letting an attacker instantiate arbitrary types; Dupe Key Confusion adds a second KeyInfo…

• SSRF Protocol Smuggling in Plaintext Credential Handlers : LDAP Willis Vandevanter

  LDAP client libraries pass CRLF through in the username and password of a plaintext simple bind, so an application letting a user set the LDAP server, port and credentials becomes an SSRF that can speak other plaintext…

• The Cookie Monster in Your Browsers filedescriptor

  A subdomain can force duplicate cookies onto its parent, while oversized cookies can make servers reject requests and legacy comma splitting can inject additional cookie values. The slides combine these browser/server…

• The world of Site Isolation and compromised renderer Jun Kokatsu

  Assuming a compromised Chrome renderer, the slides find browser-process trust gaps in postMessage, protocol handlers, Reader mode, and extension message channels. Chained with permissive extension APIs, these gaps…

• Unveiling vulnerabilities in WebSocket APIs Mikhail Egorov

  The slides survey WebSocket API weaknesses, including cross-site hijacking through weak Origin checks and missing authentication or object-level authorization on messages. They also show how incomplete reverse-proxy…

• Uploading web.config for Fun and Profit 2 Soroush Dalili

  Uploading a web.config file into an IIS application root or a subfolder to reach code execution. Managed handlers run the file itself as an ASPX page, AspNetCoreModule sets a process path, machineKey and JSON_AppService…

• x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again Soroush Dalili

  When the User-Agent starts with UP, ASP.NET takes the request body charset from the non-standard x-up-devcap-post-charset header instead of the Content-Type charset directive. An attacker encodes a POST payload in an…

• XSS in GMail's AMP4Email via DOM Clobbering @SecurityMB

  AMP4Email in Gmail allowed the id attribute, so DOM clobbering was possible. Two anchors sharing an id yield an HTMLCollection whose members can be addressed by name, and an anchor stringifies to its href, letting an…

• XSS-Auditor --- the protector of unprotected and the deceiver of protected terjanq and @terjanq

  Chrome's XSS Auditor was reverted from block mode to filter mode, so instead of stopping a page it silently strips the matched script. Reflecting a fake match aimed at a page's own defensive script deletes that script…

Added after the original list

• Abusing PHP query string parser to bypass IDS, IPS, and WAF @AndreaTheMiddle and theMiddle

  The article maps PHP’s normalization of query-string parameter names, including whitespace, brackets, null bytes, and encoded underscores, into application-visible keys. That parser differential lets crafted requests…

• Adblock Plus filter lists may execute arbitrary code in web pages

  The article shows how Adblock Plus’s `$rewrite` option let filter-list maintainers redirect Fetch or XHR code loads through same-origin open redirects, enabling arbitrary JavaScript execution in affected pages. It…

• All Your Clicks Belong to Me: Investigating Click Interception on the Web Mingxue Zhang, Wei Meng, Sangho Lee, Byoungyoung Lee and Xinyu Xing

  OBSERVER instruments Chromium to detect third-party scripts that rewrite links, attach click handlers, mimic first-party content, or place transparent overlays over it. A crawl of the Alexa top 250,000 found 437 scripts…

• Automating local DTD discovery for XXE exploitation @h3xStream

  The article automates discovery of reusable local DTD files for XXE exploitation when outbound retrieval of an attacker-hosted DTD is unavailable. DTD Finder inventories packaged DTDs, enumerates overridable entities…

• Bypassing CSP with policy injection Gareth Heyes

  A URL parameter reflected into a CSP report-uri directive lets an attacker append directives to the policy. On Edge a semicolon and underscore make the syntax invalid so the whole policy is dropped, and on Chrome an…

• Bypassing GitHub's OAuth flow Teddy Katz’s Blog

  The article explains an OAuth authorization bypass caused by Rails routing HEAD requests like GET while GitHub’s controller treated every non-GET request as an authorization POST. Because HEAD was exempt from CSRF…

• Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks Avinash Sudhodanan, Soheil Khodayari and Juan Caballero

  The paper systematizes Cross-Origin State Inference attacks into 40 XS-Leak classes and introduces a postMessage-based leak. Its Basta-COSI tool combines multiple vectors across browsers to distinguish user states…

• Cross-Site Challenge-Response Attacks Nethanel Gelernter and Itamar Peretz

  Brute-forces password and secret-code challenge-response checks across origins by making visitors' browsers submit guesses and reading success from side channels that survive the same-origin policy. One variant turns…

• DataSpii: The catastrophic data leak via browser extensions Sam Jadali and @sam_jadali

  DataSpii investigates eight Chrome and Firefox extensions that collected browsing URLs, titles, referrers, tokens, and LAN metadata and fed near-real-time analytics sold to subscribers. Controlled extension analysis…

• Detecting incognito mode in Chrome 76 with a timing attack

  The article detects Chrome 76 Incognito mode by repeatedly timing FileSystem API writes, exploiting the speed and variance difference between its memory-backed Incognito storage and disk-backed normal storage…

• Fun with URI Handlers

  The article shows how a custom Origin URI passes attacker-controlled text into a Windows command line, permitting argument injection despite quoting. Injected Qt plugin-path arguments load a DLL from a remote share for…

• GraphQL Batching Attacks wlrmblog and @Wallarm

  The article shows how GraphQL batching can pack thousands of operations into one HTTP request, undermining request-based rate limits and monitoring. Examples use batched login and OTP mutations to amplify brute force…

• Handlebars template injection and RCE in a Shopify app Mahmoud Gamal

  Researchers turn server-side Handlebars template injection into RCE by abusing JavaScript constructors, helpers, bind, and prototype mutation to build and invoke a Function body. They demonstrate the chain against…

• Hijacking browser TLS traffic through Client Domain Hooking Piotr Duszyński

  The article introduces Client Domain Hooking, a MITM technique that uses one intercepted clear-text request to keep a browser communicating through an attacker-controlled domain and reverse proxy while preserving…

• Iframes/Popups Are Dangerous in Mobile WebView: Studying and Mitigating Differential Context Vulnerabilities GuangLiang Yang, Jeff Huang and Guofei Gu

  The paper identifies differential context vulnerabilities created when browser iframe and popup assumptions are carried into Android WebView’s different UI, navigation, and API model. DCV-Hunter finds prevalent origin…

• Jackson gadgets - Anatomy of a vulnerability Andrea Brancaleoni

  The article develops a Jackson polymorphic-deserialization gadget using Logback’s JDBC connection source, first yielding SSRF through attacker-controlled JDBC URLs. When H2 is present, its remote initialization script…

• JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits Michael Schwarz, Florian Lackner and Daniel Gruss

  An automated method records every property JavaScript can read in many environments and builds templates from them, so a property stable on one system but different on another leaks the host. Two new side channels also…

• Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks Alexander Sjösten, Steven Van Acker, Pablo Picazo-Sanchez and Andrei Sabelfeld

  Browser extensions give themselves away: a page can probe web-accessible resources by URL, and an extension that injects a WAR reference into the page reveals Firefox per-profile random UUID. Combining revelation with…

• Leaky Images: Targeted Privacy Attacks in the Web Cristian-Alexandru Staicu and Michael Pradel

  Leaky images let an attacker privately share an authenticated image with a target, embed it cross-site, and infer whether that exact user visited based on load success. The paper extends the technique to group tracking…

• Measuring and Analyzing Search Engine Poisoning of Linguistic Collisions Matthew Joslin, Neng Li, Shuang Hao, Minhui Xue and Haojin Zhu

  Misspellings that happen to be real words, often in another language, slip past search engines' auto-correction, so attackers can rank malicious pages against those queries. A crawl of 1.77 million misspelled searches…

• NGINX error_page request smuggling Bert JW Regeer and Francisco Oca Gonzalez

  The whitepaper demonstrates that an NGINX `error_page` configuration which redirects to an absolute URL can reinterpret a GET body as a pipelined request. The smuggled request can cross virtual-host boundaries or…

• Permanent URL Hijack Through 301 HTTP Redirect Cache Poisoning Piotr Duszyński

  The article shows how a network attacker can answer one clear-text HTTP request with a cacheable 301 redirect, persistently steering later browser visits to an attacker-controlled HTTPS reverse proxy. It explores…

• PhishFarm: A Scalable Framework for Measuring the Effectiveness of Evasion Techniques against Browser Phishing Blacklists Adam Oest, Yeganeh Safaei, Adam Doupé, Gail-Joon Ahn, Brad Wardman and Kevin Tyers

  PhishFarm deploys 2,380 live PayPal-branded decoy phishing sites on fresh .com domains, each behind one of six request filters taken from real phishing kits, reports them to 10 anti-phishing entities and times browser…

• Postcards from the Post-HTTP World: Amplification of HTTPS Vulnerabilities in the Web Ecosystem Stefano Calzavara, Riccardo Focardi, Matus Nemec, Alvise Rabitti and Marco Squarcina

  A crawl of the Alexa top 10k plus 90,816 dependency and sub-domain hosts maps still-exploitable TLS flaws such as ROBOT, DROWN, POODLE-TLS and Heartbleed onto attack trees, then measures the web-application damage. 898…

• Practical Decryption exFiltration: Breaking PDF Encryption Jens Müller, Fabian Ising, Vladislav Mladenov, Christian Mainka, Sebastian Schinzel and Jörg Schwenk

  Modified encrypted PDFs exfiltrate plaintext when their recipients decrypt them. Partial encryption permits attacker-controlled forms, links or scripts to reference encrypted objects; unauthenticated CBC and known…

• Provoking browser quirks with behavioural fuzzing Gareth Heyes

  Behavioural fuzzing drives every Unicode code point into a chosen HTML or JavaScript position and diffs the parse result to expose browser quirks. In Firefox it shows a newline closing an HTML comment after an…

• Re-Animating ActivitySurrogateSelector Nick Landers

  Microsoft's .NET 4.8 fix for the ActivitySurrogateSelector deserialization gadget is only a type check that a hidden app setting can disable. A still-working gadget, TextFormattingRunProperties driving XamlReader and…

• Remote Code Execution on most Dell computers @BillDemirkapi and Bill Demirkapi

  The article chains Dell SupportAssist’s privileged localhost web API, reusable command signatures, weak Dell-origin checks, DNS interception, and a URL-normalization bypass into remote code execution. A malicious page…

• Requests-Racer nccgroup

  Requests-Racer is a Python transport adapter for synchronizing the completion of multiple HTTP requests, even across destinations and payload sizes, to test web application race conditions. Its documentation covers…

• Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt

  The paper reduces a broad TLS malformed-record probe set to a scalable scan and clusters response fingerprints to group related implementations. Scanning the Alexa Top Million found CBC padding oracles on 1.83% of…

• Signature validation bypass in SimpleSAMLphp and XMLSecLibs Juraj Somorovsky and Karsten Meyer zu Selhausen

  The advisory traces a SimpleSAMLphp/XMLSecLibs signature-validation bypass to an XPath query that accepts Reference elements from multiple SignedInfo nodes while verifying only the first signature. An authenticated…

• Subverting Electron Apps via Insecure Preload Luca Carettoni

  The article categorizes four ways Electron preload scripts can undermine renderer isolation, including leaked Node globals, dangerous exported functions, sandbox bypasses, and prototype tampering without context…

• Switcheroo: Windows SSDP Blind SSRF initstring

  Switcheroo shows how a LAN attacker can answer Windows SSDP discovery, then use an HTTP 301 redirect to make the target issue a blind GET to an arbitrary host, including localhost. The write-up demonstrates the blind…

• Telerik Revisited Markus Wulftange

  Re-examines CVE-2017-11317 in Telerik UI for ASP.NET and finds it is more than an arbitrary file upload: the rauPostData blob carries an assembly-qualified type name handed to JavaScriptSerializer, giving arbitrary…

• The Betrayal at Cloud City: An Empirical Analysis of Cloud-Based Mobile Backends Omar Alrawi, Chaoshun Zuo, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin and Brendan Saltaformaggio

  SkyWalker extracts backend URLs from Android apps, fingerprints operating-system, service, application, and transport layers, assigns ownership, and verifies known and web-application flaws. On the top 5,000 free Google…

• The inception bar: a new phishing method James Fisher

  Demonstrates a fake address bar after mobile Chrome hides its toolbar during scrolling. A nested scrolling region and top-boundary reset keep the real toolbar hidden as the user scrolls upward. The technique needs an…

• Turbo Intruder: Embracing the billion-request attack James Kettle

  A Burp extension built on a hand-written HTTP stack that sends requests far faster than normal tooling, reaching about 30,000 requests per second and sustaining multi-day attacks at flat memory. Python-scripted attacks…

• Universal RCE with Ruby YAML.load Etienne Stalmans

  The article adapts a universal Ruby 2.x Marshal deserialization gadget chain to unsafe YAML.load without Rails dependencies. A hand-built YAML object graph drives RubyGems classes through sorting and StubSpecification…

• Using HTTP Pipelining to hide requests Robin Wood - DigiNinja and @digininja

  The article uses HTTP/1.1 pipelining to send a benign and a second, different-host request over one TLS connection, concealing the latter’s hostname from observers who cannot decrypt traffic. Testing found the technique…

• Using WebRTC ICE Servers for Port Scanning in Chrome Jacob Baines

  The article turns Chrome’s WebRTC ICE server handling into a browser-based LAN scanner. Crafted TURN URLs force TCP probes to arbitrary ports, including normally blocked ones, and icecandidateerror details distinguish…

• What Are You Searching For? A Remote Keylogging Attack on Search Engine Autocomplete John V. Monaco

  KREEP reconstructs search queries from encrypted autocomplete traffic by combining packet timing, URL-space encoding, and HTTP/2 Huffman-compression size leaks with neural and language models. Across two search engines…

• Why npm lockfiles can be a security blindspot for injecting malicious modules Liran Tal

  The article shows how a malicious pull request can hide a dependency source replacement inside a large yarn.lock or package-lock.json diff, causing installs to fetch and run an attacker-controlled module. It recommends…

• WordPress 5.0.0 Remote Code Execution Simon Scannell

  The research chains WordPress post-meta overwrite, image-editor path traversal, and theme template inclusion into authenticated RCE. An author can redirect image processing into the active theme and plant PHP in a…

• Zoom Zero Day: 4 Million Webcams & maybe an RCE? Just get them to visit your website! Jonathan Leitschuh and /@jonathan.leitschuh

  The report finds that Zoom’s persistent macOS localhost server let any visited website force the client into a meeting, optionally activating the webcam, and repeatedly launch calls for denial of service. It also shows…