Research Academy
My account Customers About Blog Careers Legal Contact Resellers
Research hero

PortSwigger Research

Pushing the boundaries of web security

Featured Research

Server-side prototype pollution: Black-box detection without the DoS

15 February 2023 Server-side prototype pollution: Black-box detection without the DoS

Stealing passwords from infosec Mastodon - without bypassing CSP

15 November 2022 Stealing passwords from infosec Mastodon - without bypassing CSP

Browser-Powered Desync Attacks

10 August 2022 Browser-Powered Desync Attacks

uBlock, I exfiltrate

Exploiting Ad blockers with CSS 06 December 2021 uBlock, I exfiltrate Exploiting Ad blockers with CSS

Latest Research Articles

Exploiting XSS in hidden inputs and meta tags

11 July 2023 Exploiting XSS in hidden inputs and meta tags

How I choose a security research topic

14 June 2023 How I choose a security research topic

Bypassing CSP via DOM clobbering

05 June 2023 Bypassing CSP via DOM clobbering

Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

28 April 2023 Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
Research article

View all articles
Research article

Read article

Meet the Researchers

James Kettle

James Kettle

Director of Research

Gareth Heyes

Gareth Heyes

Researcher

Upcoming Talks

Smashing the State Machine: The True Potential of Web Race Conditions

Read more