Paper Have you ever discovered a header injection vulnerability and settled for little more than an open redirect or XSS? In this Briefing, we will introduce a battle-tested “header injection” pow...
When performing security research in your spare time, long running scans that may or may not result in your next research topic or bounty are difficult to ignore. To help prevent my habit of consta...
Blog I had the awesome opportunity to head to DEFCON 33 this year with some help from Portswigger! As a result of the trip, I also got the chance to absolutely nerd out about their latest research...
This research was originally presented at BSides Exeter 2025: Research Despite HTTP Request Tunnelling’s resurgence in recent years with the advent of HTTP/2 Desync Attacks, its much bolder big ...
Research Exploiting CORS can be a tricky in modern web apps, but there are still critical cases out there if you know what to look for. If you want to learn more about CORS exploitation, the resea...
Recording This presentation was released at the first ever BSides Exeter! Are you a new or aspiring penetration tester attempting to navigate the seemingly endless stream of complex new informati...
Write-up In this blog post, my colleagues at Outpost24 and I walkthrough some of the wilder Cross-Site Scripting attacks we’ve managed to conceive recently, and highlight the importance of conside...
Web Cache Deception, first discovered (I think…) here, is a rare attack class that enables an attacker to trick users into storing sensitive information in a server-side cache for later retrieval. ...
Original Blog Post Webinar In this blog I discuss the advantages of Penetration Testing as a Service and how a hybrid approach to Application Security, utilizing automated vulnearbility scanning ...
Write-up In this blog (linked above) I walkthrough one of the most complex exploits I have created to-date resulting in application-wide session hijacking via HTTP Request Smuggling. The exploit a...