Pinned post
Remember you can always find my full research portfolio, upcoming presentations and contact details at jameskettle.com
James Kettle
Verified account This account is verified. Learn more@albinowax
Director of Research at @PortSwigger. Startup advisor. Find my research, tools & contact details at jameskettle.com
107 Following 86K Followers 5.4K Posts
Latest posts 5
$300k for a trusted internal header! I wonder if Param Miner found it... congrats to the discoverer either way!
The $300k bug was the most serious: during internal testing, four months before launch, an auth check trusted a header added by a local proxy as proof a request was safe. A migration added a second proxy layer, so outside requests could carry that header too. It exposed internal testers’ tokens and conversations in pre-release VMs.View quoted post on X
At that time, the product was still in early internal testing. We shut down the whole service, removed the header and continued by eliminating trust of the local machine altogether.
I've been nominated for the SANS Difference Makers Awards, in the Red Teamer category! I'd love your vote: feedback.sans.org/733559
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers
*I'll also share it if I lose
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers
*I'll also share it if I lose
daybreak-blue cares so much about authorisation, I asked it to patch a bug in "scope add" and it removed the feature to make scope read-only 🤣
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇View quoted post on X
I've started a new research project for Black Hat USA 2027 and I'm pleased to announce it has nothing to do with HTTP Desync Attacks! In spite of my best efforts, HTTP/1.1 isn't going to die anytime soon, but it's time for me to explore something else :)
*accidental desync research may still occur
*accidental desync research may still occur