Burp Suite Enterprise Edition is now available in our secure Cloud  –  Learn more
Research Academy
My account Customers About Blog Careers Legal Contact Resellers
Research hero

PortSwigger Research

Pushing the boundaries of web security

Featured Research

Introducing SignSaboteur: forge signed web tokens with ease

22 May 2024 Introducing SignSaboteur: forge signed web tokens with ease

Making desync attacks easy with TRACE

19 March 2024 Making desync attacks easy with TRACE

Blind CSS Exfiltration: exfiltrate unknown web pages

05 December 2023 Blind CSS Exfiltration: exfiltrate unknown web pages

Smashing the state machine

the true potential of web race conditions 09 August 2023 Smashing the state machine the true potential of web race conditions

Latest Research Articles

Refining your HTTP perspective, with bambdas

29 May 2024 Refining your HTTP perspective, with bambdas

Introducing SignSaboteur: forge signed web tokens with ease

22 May 2024 Introducing SignSaboteur: forge signed web tokens with ease

Making desync attacks easy with TRACE

19 March 2024 Making desync attacks easy with TRACE

Using form hijacking to bypass CSP

05 March 2024 Using form hijacking to bypass CSP
Research article

View all articles
Research article

Read article

Meet the Researchers

James Kettle

James Kettle

Director of Research

Gareth Heyes

Gareth Heyes

Researcher

Martin Doyhenard

Martin Doyhenard

Researcher

Zakhar Fedotkin

Zakhar Fedotkin

Researcher

Upcoming Talks

Splitting the email atom: exploiting parsers to bypass access controls

Read more

Gotta Cache Em All: Bending the Rules of Web Cache Exploitation

Read more

Listen to the Whispers: Web Timing Attacks that Actually Work

Read more