Tom Stacey

Did you know you can use HTTP header injection to trigger response queue poisoning and make it rain credentials? Learn how with the new @portswiggerres.bsky.social whitepaper "CRLF-Powered Desync Attacks: Beheading HTTP Streams" by @turtlesec.io and I. Read the full paper below 👇

XSS from a response header 🤯 Firefox will load an XSLT stylesheet from a data: URL in a Link header. Combined with a harmless XML body and you get JS running in the page origin. Plus Safari importing GIFs as SVG and more sanitizer bypasses: portswigger.net/research/sca...

Building on my research, my colleague Alex exfiltrated a 600-character hex token instantly using just background images and selectors. No recursive imports. portswigger.net/research/sma...

Chrome's new <microphone> tag has something to say: Another XSS vector for our cheat sheet, found by omidxrz. portswigger.net/web-security...

Just about to land in Stockholm for SEC-T! Can't wait to meet you all - you can catch the final public delivery of "Can AI Do Novel Security Research? Meet the HTTP Terminator" at 11:15 tomorrow! Do say hi - I'm very happy to chat research, AI, Burp, lifting... also I have stickers.

I put a JavaScript URL inside an HTML tag name, and every browser executed it. Apparently, tag names are code now. portswigger.net/research/wha...

I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: portswigger.net/research/css...

Next week I'll present "Can AI Do Novel Security Research? Meet the HTTP Terminator" at @defcon.bsky.social & Black Hat USA! I'm really excited to share this one - got some spectacular outcomes from a wild research journey. See you there!

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

Come and see Tobia from @turtlesec.io and I at @blackhatevents.bsky.social and @defcon.bsky.social next week! We cannot wait to share what we've found!

I haven't posted a crazy XSS vector for a while... Works on every browser

Finding a technique that initially seems to be a one-off "oh cool that worked" case, but then works on other apps with a few small tweaks is what research is all about, and it is so. much. fun. 🔥

Thrilled to announce that @turtlesec.io and I are bringing "CRLF-Powered Desync Attacks: Beheading HTTP Streams" to @defcon.bsky.social. These techniques are producing some truly horrific case studies and we can't wait to share them with you from the main stage!

Asked claude to write a basic scan check for a weird variation of my research topic on my pipeline that I've checked *several* times myself... Instantly spat out another horrendous RQP case. 🤦‍♂️ There is a lesson in here somewhere...

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer! The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below: jorianwoltjer.com/blog/p/stori... (and thanks @garethheyes.co.uk for making Shazzer!)

i should frame this

back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

Do you have experience in penetration testing, perhaps primarily within web security, and want to continue developing your skills? We are looking for a Senior Penetration Tester to join Assured! Read more and apply: www.assured.se/careers/open... #cybersecurity #pentest #infosec #jobs

If there's one thing researchers need more of, it's time. Ironically by automating huge parts of the research process, it sounds like you end up with too many new leads... That's a nicer problem to have though 😁.

I just did an interview with @mutantzombie.bsky.social with teasers for my upcoming #BHUSA presentation "Can AI Do Novel Vulnerability Research: Meet the HTTP Terminator", plus reflections on the Top Ten Web Hacking Techniques of 2025 & 2026. Watch it here: www.youtube.com/watch?v=fOWh...

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at Black Hat USA! Check out the abstract: blackhat.com/us-26/briefi...

Me and @t0xodile.com submitted our latest research to DEF CON 34 CFP, hopefully we get to present it on the big stage! But regardless, it's going to be a banger 🔥

The idea that you can go from "0.CL expect-detection v2: 0/200" to a full desync in minutes if the target lets you know that it's running IIS is absolutely bonkers...

Prepping CFPs this year has been a great feeling. Something about actually writing down everything we've discovered / built during research from tooling, novel techniques and even bounties gives you that perspective of what we've actually achieved... Mega excited for this one!

Love it when someone mentions a vuln class to you that sounds cool and then is suddenly applicable in your very next test! SSRF blacklist bypass using DNS rebinding. The Single-packet attack continues to make my stupid race condition ideas a reality.

I'm making a habit of writing down literally any thought that suddenly pops into my head related to research leads. I'm finding it fun to laugh at my own ideas. But all of a sudden, I also have a long list of fun/interesting ideas to try before I need to panic about running out of ideas.

The fact that I can use claude in the background to adjust custom tooling on the fly to test out relatively insane theories on the off chance they work all without losing any measurable time for my actual test is really really powerful.

Spring is just around the corner, and that's when I offer online training courses on Burp Suite Pro 👨‍🏫 Two sessions are planned (in English and French), and there are still a few spots left in each. Contact me to get an early-bird discount code! 💰

Our embedded security and cryptography expert Joachim Strömbergson guested a Swedish security podcast (Bli Säker @nikkasystems.com) and discussed Post Quantum Cryptography. Find our English summary and the link to the episode in our blog. www.assured.se/posts/podcas... #pqc #security #cryptography

Going here github.com/vladko312/Re... and implementing a selection / all of these into Backslash-Powered Scanner (or a custom scan check...) is probably very useful. The real work comes from creating a safe but syntactically similar payload for the probe pair. Bring back SSTI!

The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted! portswigger.net/research/top...

Got one of our most impactful cases re-opened and accepted after a quick email chain. Always happy to see programs supporting researchers in this way. Going to try writing my reports with a public disclosure section right at the top to see if this helps in these cases.

Spent a long time on a case over the last few weeks getting absolutely nowhere. Remember to try this, instant RQP... I must remember to take my own advise occasionally.

Celebrating 100 #security assessments, over 1000 findings, and over 2000 pages of #pentest reports in 2025! www.assured.se/posts/100-se...

Love web & AI security research? Want to do it full time on-site with myself, Gareth Heyes & Zak Fedotkin? Join the PortSwigger Research team - we're hiring! apply.workable.com/portswigger/...

We got our "bigmac" 🍔 AI machine up and running today! Time to find out if I can start using shadow-repeater every day 🔥

Cybersecurity in #MedTech is no longer something you "add later." Under #MDR / #IVDR, security is a prerequisite for market access, not an optional feature. When addressed too late, the result is rework, delays, or products that never make it to market. Read more: www.assured.se/areas/medtec...

🐛 Built a simple RSS reader called Feedworm that runs in DevTools and never phones home. Keep up with blogs and research without selling your data. thespanner.co.uk/introducing-...

Needed a custom hackvertor tag for reasons. IIRC there's this AI integration now right? **enter prompt**. Oh okay it works and I'm done. I suspect I've been sleeping on this... One of my favourite extensions atm.

Voting is now live for the top ten web hacking techniques of 2025! Grab a brew, browse the 61 quality nominations and cast your vote on the most creative and ground-breaking techniques: portswigger.net/polls/top-10...

On a whim I asked Gemini a ridiculously specific question. "Give me a response that has length X and is text/html for X proxy". And while it basically made up the answer (I assume) it still pointed me to a solution I've needed for months! I Guess trying "stupid ideas" can work for LLMs too.

Kom och jobba med mig! @assuredab.bsky.social söker nytt blod. Bland annat en säljansvarig för #securityengineering #allthecybers #cra #nis2 #dora #sdlc www.assured.se/sv/jobb/ledi...

Nominations for the Top 10 (new) Web Hacking Techniques of 2025 are now live! Review the submissions & make your own nominations here: portswigger.net/research/top...

[Blog Post] Turning the List-Unsubscribe SMTP Header into an SSRF/XSS Gadget security.lauritz-holtmann.de/post/xss-ssr... Once again, ancient RFCs and overlooked security hot spots in specifications turned out to be worthwhile for security research. Read the spec!