PortSwigger Research

We are in a similar space, our tool (https://caido.io) is geared toward bug bounty hunters and pentesters. HTTP Toolkit looks great congrats to the dev! It seems to compete more with requestly (https://requestly.io/) than burp suite (https://portswigger.net/).

Charles is nice, but I go with Burp [1]. It requires more work, but the extra goodies are worth it. [1] - https://portswigger.net

I bought the first one and it was brilliant. I've known Daf (the author) for a few years now, he's also the author of the amazing Burp Suite[1] - if you're a developer do try the free version then consider getting the pro suite, which has a stupid volume of features for a relatively small amount of money. WAHH should be standard reading for anyone that wants to learn about Web Application attacks. I'd also highly recommend the Shellcoder's Handbook (although that could do with an update too). I will definitely be buying both the 2nd edition of WAHH and the try it bits too when it comes out. [1] - http://www.portswigger.net/

Most of these attack vectors have been known for 10 years, and yet researchers keep finding bugs in major implementations to this day. Here's one from last week: https://portswigger.net/research/the-fragile-lock > How would you digitally sign a Json document and embed the signature in the document? You would not, because that's exactly how you get these bugs. Fortunately serialization mechanisms, whether JSON or Protobuf or XML or anything else, turn structured data into strings of bytes, and signature schemes operate on strings of bytes, so you'll have a great time signing data _after_ serializing it.

Reading this and following links, eventually you'll get to this page https://portswigger.net/research/talks?talkId=32 which hypes a conference presentation at DefCon on Aug 8. So, I can't tell if it's real(ish) or advertising.

Appreciate you pointing that out. HTTP/1.1 may be relatively long in tooth, but this particular vulnerability seems straightforward to mitigate to me. Especially at the CDN level. Following through the links referenced in the article, this appears to be the actual underlying research: https://portswigger.net/research/http-desync-attacks-request-smuggling…

Sine you already know frontend, I would recommend starting with burpsuit and web exploitation. The issue with cybersec is that there are just too many things you can/need to learn, so the best thing would be to start with the area you already know something about. https://portswigger.net/web-security is a great resource to get you started. Good luck!

New amazing web security research by James Kettle: Smashing the state machine: the true potential of web race conditions https://portswigger.net/research/smashing-the-state-machine The talk (on YouTube) is also absolutely brilliantly done. James finds new vulnerabilities classes where others don’t even see potential for problems. Absolutely amazing!

This is a pretty clever combination of feature misuse, although I think I'd rate the overall security impact fairly low, because the best-case scenario is that you cause the recipient to open a link in their browser. That can be useful in some cases, but unless the attacker is a police force, intelligence agency, or similar, there would usually need to be some kind of follow-up attack, e.g. exploiting unpatched software on the device. In the interest of technical accuracy, I don't think I'd label this one "clickjacking" specifically. "Clickjacking" usually refers to a very specific technique that involves invisible HTML frames overlaid on top of other content.[1][2] [1] https://owasp.org/www-community/attacks/Clickjacking [2] https://portswigger.net/web-security/clickjacking

There is not, which is what leads to vulnerabilities where two HTTP protocol parsers will parse the same request in two different ways (which led to the HTTP desync attacks). https://portswigger.net/research/http-desync-attacks-request-smuggling… There's a reason why web servers will slam the door shut even when the client requests HTTP Keep Alive because they are unable to properly parse a request in a way that makes it safe to parse a follow-up request on the same TCP/IP connection.

Is the 'Burp' mentioned in this, the 'Burp Suite' that can be downloaded here? https://portswigger.net/burp/communitydownload Am new to this kinda stuff but would love to play with it. Always love reading up on responsible disclosures.

No love for burp[0] here? I really like it.. It's technically a security research tool (and thus, hilariously frustrating to try and get approved by the desktop people at say, a bank) and the UI is a bit old school, but it's never once annoyed me.. 0: https://portswigger.net/burp

So like BURP Suite(https://portswigger.net/) but with fewer features?

Actually, a lot less. HTTP/2 frames are done as a binary protocol with fixed offsets, and instead of having three different transfer modes (chunked, keep-alive, and one-shot), HTTP/2 has only its version of chunked. The best way to exploit an HTTP/2 server is to exploit the HTTP/1.1 server behind it [1]. [1]: https://portswigger.net/research/http2

A bunch of great answers. I've been in offensive security for ~10 years now and am a staff at one of these billion dollar SV tech companies now. If you want to do pentesting (though i prefer the team offensive security) my advice is to learn the basics of web app security with something like portswigger's course https://portswigger.net/web-security. Since most tech is really API's and web apps this course would be able to get you productive and probably a jr level skillset. OSCP is also good but I find network hacks are not as applicable today thanks to the cloud, though the thinking process and creative puzzle solving could be worth it. I would particpate in as many CTF type challenges as possible (http://www.xssgame.com) then apply to jobs. Make it clear you are a junior but good at Burp and web testing. Good luck!

I work as a pentester, and if you want to learn web security, I would strongly recommend PortSwigger Web-Security labs over WebGoat (it's free too). https://portswigger.net/web-security Hackthebox with ippsec's videos is also a fantastic resource. Liveoverflow's youtube channel and pentesterlab are also really good.

Tools such as Zap and Burp Suite are great for web devs who want to learn how to build secure websites. I highly recommend them: https://owasp.org/www-project-zap/ https://portswigger.net/burp

Agreed jfrog has the more in-depth exploration in this case. Still, James Kettle from Portswigger has donegood work in this area; I'd recommend anyone who's not familiar with HTTP request smuggling read https://portswigger.net/research/http-desync-attacks-request-smuggling…

I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics. Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities. If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security

Application Security Engineer here. For a developer I would recommend the OSWE certification which takes a more code-centric approach and resources such as https://portswigger.net/web-security and The Art of Software Security Assessment book. You can also leverage your DevOps experience for learning about server, app and cloud misconfigurations and their impact on security. The demand for network security is not as high as for appsec people and I personally don't see network security as very rewarding (intellectually and financially). For the Pentesting route I recommend trying some HackTheBox and watching Ippsec's channel (https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA). OSCP is fine, but it is a beginner certification and definitely not enough for getting a Pentest job.

Judging by "ReferenceError: webkitRTCPeerConnection is not defined" message in my browser it probably uses WebRTC to get your local IP subnet. I installed an add-on to block WebRTC after I watched a presentation on this tool [1][2] and I recommend you also do this, unless you actively use WebRTC (and don't want the hassle of toggling a switch). Unfortunately the protocol is vulnerable by design. :( [1] https://portswigger.net/daily-swig/new-tool-enables-dns-rebinding-tunn… [2] https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel-explore-i…

The downside being that the browser will attach it to every request; if you use cookies, you MUST be aware of this, or you are (IMO) pretty much guaranteed to write a CSRF vuln. (I'm much more in the localStorage + Authorization header for this reason. I recommend [1] for reading. If malicious JS is running, cookies won't save you, since the malicious JS is capable of simply making the request itself, to which the cookie will automatically be attached by the browser. localStorage+JS eliminates CSRF. If someone XSS's you, the difference is irrelevant.) [1]: http://blog.portswigger.net/2016/05/web-storage-lesser-evil-for-sessio…

If your use cases allow for graphical apps, there's a couple that are heavily used by the web app. security testing community and have quite a bit of useful functionality for inspecting/modifying HTTP(s) requests. OWASP ZAP Proxy - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project Burp Suite - https://portswigger.net/

You're right. Not MITM but decoding tap. If you want a true MITM proxy then I recommend Burp https://portswigger.net/burp/

If you're a small startup looking to automate security testing against your application, I strongly recommend just shelling out for Burp Suite; it's like a couple hundred bucks tops, can be used to automate almost every common web app attack, and is the tool most likely to be used by good auditors when you eventually decide to get tested professionally. http://portswigger.net/burp/ There's a free version, which disables the (mostly vestigial, anyways) "scanner", and slows down the fuzzer tool; if you're really automating security testing --- which, do --- pay for the real version; you want the fuzzer to work. There are things sqlmap does that Burp does not do easily, but they're not important to app developers; if you're generating database exceptions with inputs, don't dick around trying to make time-based blind SQL work; just fix the bugs.

If you need to do this manually, then Burp Proxy (http://portswigger.net/proxy/) might be useful. However if you need automate that then you'd probably have to implement your own custom HTTP proxy. Just find a library for your favorite language that can help with that.

While looking at the recommendation, I noted that the book's website has a page of links to tools: http://portswigger.net/wahh/tools.html Nothing eyebrow raising, but if you're starting out, worth knowing about.

Does obtaining Global Entry minimize the chance of them deciding to harass a citizen crossing the border, I wonder? It is at the cost of your biometric - but data on your devices might be worth more, and as I note elsewhere in this thread, you can image a computer and back it up fully, but not a phone without some data loss, unfortunately. [ TWRP possibly can do it right perhaps, but it requires unlocking the bootloader (which wipes the phone), and once bootloader is unlocked, it's more vulnerable to Cellebrite and company, to my understanding, ] seeing the latest (leaked?) Cellebrite info from 2024 Summer- BFU State[Before First Unlock state] after posting on, modernimoPuxelsiPhones on the latest OS, and graphene devices see moto be the hardest to get into. Anyway- , with computers - this was a solved problem from a technical standpoint- Yes I'm talking Truecrypt then, and today Veracrypt. The Hidden Container feature is impressive- but the Hidden OS feature allows for a truly hidden OS behind the scenes that can't be found at all. However, there's a unfortunate weakness that makes this hard to use today- it's limited to MBR , not UEFI [GPT]systems- so unless you like your computer not being able to have more than 2 Tb - and only 4 partitions (so good luck If you do a lot of stuff from dualbooting to other whatnot) We need a Veracrypt Hidden OS equivalent for UEFI systems that's truly undetectable.(That also will work for Linux and maybemeMac not just Windows as…

>Also CORS and SOP can be bypassed: https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm Like I said, you can reimplement SOP by checking that the Origin header equals the Host header. Or alternatively check them against an allowlist. It's just a couple lines of code, and then it's as secure as normal HTTP. https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm That article contains a confusing quote: >The initial handshake occurs via HTTP Upgrade request, the response body is disregarded and the HTTP/HTTPS protocol is upgraded to WS/WSS protocol. But the response body isn't disregarded. What could best be described as the response body is the server->client websocket messages. Those aren't disregarded. >Even very experienced teams make mistake with this kind of things. See for instance, this Kubernetes vulnerability: https://goteleport.com/blog/kubernetes-websocket-upgrade-sec... Thanks, that's an interesting vulnerability. I'm not so sure it's websocket-specific though. It looks like the attack could be done without websockets at all. The end request that does the malicious action is plain HTTP. The initial request that triggers the desync uses a Connection: Upgrade header, which is used in websockets, but isn't actually websocket-specific. Connection: Upgrade was created in RFC 2616 from 1999, which was before the websocket RFC 6455 in 2011. The vulnerability was there was a proxy, and the proxy didn't properly handle the Connection header as specified…

Bit of a rambly reply: There are different types of web security vulnerabilities and the attacks you see from automated scanners are likely to be far less sophisticated than targeted web attacks. Specifically these scanners are going to spam out widespread and common CVE's that might grant privileged access to the server or dump credentials in some fashion. The more sophisticated attack you described is essentially an overflow, and most modern web servers are usually written in memory-safe languages making it very unlikely to see that type of attack on the web. More often it's the underlying OS, servers, or communication stacks (bluetooth, TCP, nginx, etc) that have these types of vulnerabilities since they are often written in low level non memory safe languages like C and C++. Attacks that exploit the HTTP and HTTPS protocol are a little more interesting. Request smuggling lets you trick certain load balancers and webservers by sending an HTTP request "smuggled" inside of another HTTP request. Here is a blog by James Kettle's about some request smuggling vulnerabilities and the impact they can have. https://portswigger.net/research/http2 There's really a lifetime's worth of knowledge on web security and the type of stuff you see in scans is just trying to hit the low hanging fruit. Portswigger has loads of free challenges and information about different web security topics. https://portswigger.net/web-security/all-topics