Tom Stacey

@t0xodile

Security researcher at PortSwigger. You can find all of my write-ups and research at thomas.stacey.se.

Knutsford, England

thomas.stacey.se

Joined June 2014

271 Following

1,058 Followers

Replies Reposts Media

Pinned
Tom Stacey
@t0xodile
Aug 12
Did you know you can use HTTP header injection to trigger response queue poisoning and make it rain credentials? Learn how with the new @PortSwiggerRes whitepaper "CRLF-Powered Desync Attacks: Beheading HTTP Streams" by @m4st3rspl1nt3r and I. Read the full paper below 👇
1
Tom Stacey
@t0xodile
Nov 4
Burp scanner now detects request-header injection, and Burp AT contains a researcher-crafted skill that weaponises it into a high-impact PoC with a single prompt! It'll even do CRLF-Powered Tunnelling if full desync exploitation isn't viable. Read below for full details:
3
Tom Stacey
@t0xodile
Sep 23
Turbo Intruder 2 has landed! You can now surpass 100,000 RPS over WiFi using the new HTTP/3 engine, test HTTP/3 exclusive targets with the Burp adapter, and deploy new research-grade race condition techniques! Check out the post below for full details:
3
Tom Stacey
@t0xodile
Sep 17
Some epic research from @Brumens2 🔥
YesWeHack ⠵
@yeswehack
Sep 17
Cache poisoning isn’t always about unkeyed input🔑 At @BugBountyDEFCON, @Brumens2 showed how cache key injection can lead to unauthenticated cache deception, CPDoS and stored XSS via scheme fragments 🧪 This research is now live on our blog 👇 yeswehack.com/lab/research-c…
1
Tom Stacey
@t0xodile
Aug 8
30 minutes to go! Livestream available here: youtube.com/live/PhXJ_-iJq…
Tom Stacey
@t0xodile
Aug 8
Today @m4st3rspl1nt3r and I present the @defcon edition of “CRLF-Powered Desync Attacks: Beheading HTTP Streams”. Come to track 3 on main stage at 17:00 to learn to build your very own desync worm and find real-world impact even when your desync can’t impact other users directly!

Tom Stacey

Tom Stacey’s posts