James Kettle

Folkestone

Freelance Contributor at Freelance

writes jokes, doesn’t say them. stage and screen. late night lycett words

Featured in: Favicon

theguardian.com Favicon

yorkshirepost.co.uk Favicon

lincolnshirelive.co.uk Favicon

thedigitalfix.com Favicon

scifibulletin.com Favicon

on-magazine.co.uk Favicon

bbc.co.uk

Articles

Top 10 web hacking techniques of 2024

2 months ago | portswigger.net | James Kettle

Published: 04 February 2025 at 15:01 UTC Updated: 04 February 2025 at 15:20 UTC Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year. This post is the culmination of a three-step collaboration with the security community.
Top 10 web hacking techniques of 2024: nominations open

Jan 8, 2025 | portswigger.net | James Kettle

Published: 08 January 2025 at 14:07 UTC Updated: 08 January 2025 at 14:39 UTC Nominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, and whitepapers. These contributions are all invaluable, but some stand out for their innovative approaches and the potential to be re-applied or adapted in new ways.
Top ten web hacking techniques of 2024: nominations open

Jan 8, 2025 | portswigger.net | James Kettle

Published: 08 January 2025 at 14:07 UTC Updated: 08 January 2025 at 14:07 UTC Nominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, and whitepapers. These contributions are all invaluable, but some stand out for their innovative approaches and the potential to be re-applied or adapted in new ways.
Listen to the whispers: web timing attacks that actually work

Aug 7, 2024 | portswigger.net | James Kettle

Published: 07 August 2024 at 18:10 UTC Updated: 07 August 2024 at 18:14 UTC Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets including masked misconfigurations, blind data-structure injection, hidden routes to forbidden areas, and a vast expanse of invisible attack-surface.
A hacking hat-trick: previewing three PortSwigger Research publications coming to DEF CON & Black Hat USA

Jul 2, 2024 | portswigger.net | James Kettle

Published: 02 July 2024 at 12:57 UTC Updated: 02 July 2024 at 13:15 UTC We're delighted to announce three major research releases from PortSwigger Research will be published at both Black Hat USA and DEF CON 32. In this post, we'll offer a quick teaser of each talk, info on accompanying tools and labs, and suggested pre-reading to get the most out of them.
Refining your HTTP perspective, with bambdas

May 29, 2024 | portswigger.net | James Kettle

Published: 29 May 2024 at 13:31 UTC Updated: 29 May 2024 at 13:31 UTC When you open a HTTP request or response, what do you instinctively look for? Suspicious parameter names? CORS headers? Some clue as to the request's origin or underlying purpose? A single HTTP message can tell a different story to every viewer, but modern websites send thousands so it's all too easy to overlook something critical.
Top 10 web hacking techniques of 2023

Feb 19, 2024 | portswigger.net | James Kettle

Published: 19 February 2024 at 14:31 UTC Updated: 19 February 2024 at 14:31 UTC Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year. This year, in response to our call for nominations the community submitted a record 68 entries, and cast votes to select 15 finalists.
Top 10 web hacking techniques of 2023 - nominations open

Jan 9, 2024 | portswigger.net | James Kettle

Published: 09 January 2024 at 14:33 UTC Updated: 09 January 2024 at 14:38 UTC Nominations are now open for the top 10 new web hacking techniques of 2023! Over the last year, numerous security researchers have shared their discoveries with the community through blog posts, presentations and whitepapers. Many of these posts contain innovative ideas waiting for the right person to adapt and combine them into new discoveries in future.
Finding that one weird endpoint, with Bambdas

Dec 12, 2023 | portswigger.net | James Kettle

Published: 12 December 2023 at 14:11 UTC Updated: 12 December 2023 at 14:11 UTC Security research involves a lot of failure. It's a perpetual balancing act between taking small steps with a predictable but boring outcome, and trying out wild concepts that are so crazy they might just work... but probably won't.
The single-packet attack: making remote race-conditions 'local'

Oct 18, 2023 | portswigger.net | James Kettle

Published: 18 October 2023 at 12:54 UTC Updated: 18 October 2023 at 12:59 UTC The single-packet attack is a new technique for triggering web race conditions. It works by completing multiple HTTP/2 requests with a single TCP packet, which effectively eliminates network jitter and means the requests get processed extremely close together. This makes remote race conditions just as easy to exploit as if they were local.