Tom Stacey

t0xodile.com

06 May 2026 09:39

If there's one thing researchers need more of, it's time. Ironically by automating huge parts of the research process, it sounds like you end up with too many new leads... That's a nicer problem to have though 😁.

Jorian

jorianwoltjer.com

30 April 2026 14:04

Cool exploit with @0x999.net: He found that \x7F breaks Chrome's "Copy as cURL (cmd)" command parsing in Windows Console Host. In combination with a ", it allowed you to add any arguments to curl. With -o writing files is easy, but we need the username for the startup path... (1/2)

James Kettle

jameskettle.com

30 April 2026 14:04

I just did an interview with @mutantzombie.bsky.social with teasers for my upcoming #BHUSA presentation "Can AI Do Novel Vulnerability Research: Meet the HTTP Terminator", plus reflections on the Top Ten Web Hacking Techniques of 2025 & 2026. Watch it here: www.youtube.com/watch?v=fOWh...

Gareth Heyes

garethheyes.co.uk

22 April 2026 21:44

If you haven't tried Shazzer yet you should give it a go. You can easily find browser behaviour and get it tested by other users or your team. It supports private vectors too and you can assign them to your team. You can even have your own private fuzzing network. 🔥🔥🔥

Gareth Heyes

garethheyes.co.uk

22 April 2026 21:44

0x10000 is 0xffff+1. So to generate A you do: String.fromCharCode(0x10000 + 0x41)//A All this is explained in: portswigger.net/research/spl... 2/2