Pinned Tweet
Remember you can always find my full research portfolio, upcoming presentations and contact details at jameskettle.com
10
30
275
71,467
daybreak-blue cares so much about authorisation, I asked it to patch a bug in "scope add" and it removed the feature to make scope read-only 🤣
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
5
1
79
7,843
James Kettle retweeted
Six consuming tags. One Safari trick: <select>.
Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet:
Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet:
1
11
54
3,636
I've started a new research project for Black Hat USA 2027 and I'm pleased to announce it has nothing to do with HTTP Desync Attacks! In spite of my best efforts, HTTP/1.1 isn't going to die anytime soon, but it's time for me to explore something else :)
*accidental desync research may still occur
*accidental desync research may still occur
10
3
317
11,403
Just wanted to say thanks to everyone who said hi at @OffensiveAIcon! So many memorable conversations with interesting people… you’ve given me a lot to mull over as I reacclimate to the Manchester weather.
0
0
22
3,814
I'm not sure why, but requesting Anthropic CVP auto-suspends your account. If you appeal you'll probably get it back.
6
5
116
12,720
Update: I hear the suspension only happens if you have a key with an expiry over seven days. Useful to know in advance!
1
0
12
1,740
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
12
37
245
25,544
Read the full details here: portswigger.net/research/the-m…
0
11
71
4,828
James Kettle retweeted
Building on my research, my colleague @Alex_______C exfiltrated a 600-character hex token instantly using just background images and selectors. No recursive imports.
2
13
120
7,564
I recently spotted something sneaky & unexpected about how AI approaches original hacking research...
Excited to share it tomorrow at 2pm at @OffensiveAIcon! Writeup to follow.
Excited to share it tomorrow at 2pm at @OffensiveAIcon! Writeup to follow.
4
6
121
5,601
James Kettle retweeted
Chrome's new <microphone> tag has something to say:
Another XSS vector for our cheat sheet, found by @omidxrz.
Another XSS vector for our cheat sheet, found by @omidxrz.
3
11
121
4,270
SMTP smuggling is back! Dot-stuffing is a great find, awesome work!
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as tim.cook@icloud.com, exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/fr…
1
29
347
27,378
It's a year since I started to build the HTTP Terminator and AI models have come a long way, but taking the step from design to vibe-coded implementation on an ambitious project still feels like jumping of a cliff.
4
1
67
13,642
James Kettle retweeted
Stuck inside a <meta> and angle brackets blocked?
You can still get XSS...
In Firefox, use hidden=until-found and onbeforematch with a URL hash to trigger your handler.
Now in our XSS cheat sheet, thanks to @avlidienbrunn
You can still get XSS...
In Firefox, use hidden=until-found and onbeforematch with a URL hash to trigger your handler.
Now in our XSS cheat sheet, thanks to @avlidienbrunn
1
29
118
5,357
High-impact findings used to be a core pillar of a good BHUSA/DEFCON presentation, alongside novel ideas & storytelling. Now they're table stakes... beyond pwning half the planet like @_splitline_, what makes a presentation really land for you?
9
0
100
10,872
One million requests in 10 seconds, over WiFi. Turbo Intruder 2 has landed!
Turbo Intruder 2 has landed! You can now surpass 100,000 RPS over WiFi using the new HTTP/3 engine, test HTTP/3 exclusive targets with the Burp adapter, and deploy new research-grade race condition techniques! Check out the post below for full details:
4
10
157
14,720
My latest presentation has landed on YouTube, courtesy of @SEC_T_org! Can AI do novel security research? You know it.
youtube.com/watch?v=jCFZFD…
youtube.com/watch?v=jCFZFD…
3
18
91
7,914
@SEC_T_org If you missed it first time around, you can find the whitepaper here: portswigger.net/research/can-a…
0
0
6
1,169
James Kettle retweeted
Cache poisoning isn’t always about unkeyed input🔑
At @BugBountyDEFCON, @Brumens2 showed how cache key injection can lead to unauthenticated cache deception, CPDoS and stored XSS via scheme fragments 🧪
This research is now live on our blog 👇
yeswehack.com/lab/research-c…
At @BugBountyDEFCON, @Brumens2 showed how cache key injection can lead to unauthenticated cache deception, CPDoS and stored XSS via scheme fragments 🧪
This research is now live on our blog 👇
yeswehack.com/lab/research-c…
1
33
123
9,593