joernchen

PortSwigger dropped their Top 10 Web Hacking Techniques of 2025 and we covered all of them on the pod (in a completely random order) Here's a quick intro of the first 5 we talked about: <ul> 10 - @joernchen's parser differential talk from OffensiveCon25 is 28 minutes and worth every one of them. The JSON duplicate keys example is the entry point, Erlang reads the first `roles` key, JS reads the last, auth bypassed but the double Authorization header trick is our fav part: First header is the unsigned JWT with whatever admin attributes you want. Second is your legit low-priv token. Frontend validates the second and the backend grabs the first. youtube.com/watch?v=Dq_KVLXz… 8 - @salvatoreabello's XSS-Leak has nothing to do with XSS, it's a timing attack against Chrome's connection pool scheduling that leaks cross-origin subdomains without any injection. CTFy origin, but the writeup covers applications outside the CTF context. Chromium only. blog.babelo.xyz/posts/cross-… 9 - @flomb_'s HTTP/2 CONNECT research needed an extra read off-camera to fully appreciate. He built a Go-based port scanner that runs entirely through HTTP/2 CONNECT tunnels — successful connection returns :status 200, failed returns :status 503. Push raw HTTP/1.1 requests through and read back responses from internal services. If a target accepts CONNECT over HTTP/2, that's a free port scan and SSRF with no other precondition needed. blog.flomb.net/posts/http2co… 7 - @zhero___'s Next.js research goes after the framework's internal cache. `__nextDataReq=1` turns the page response into JSON, `x-now-route-matches` tricks Next.js into treating the request as SSG, flipping `Cache-Control` to cacheable. `__nextDataReq` isn't in the cache key, but `Accept-Encoding` is and every browser sends it... zhero-web-sec.github.io/rese… 5 - @chudyPB's SOAPwn is a quick 93 page read. It's a quirk in how .NET handles HTTP client proxies: feed `HttpWebClientProtocol` a `file://` URI instead of HTTP, the cast fails silently while HTTP setup gets skipped and the SOAP body gets written straight to disk. watchtowr.com/wp-content/upl…