Independent research index / First release
Web security
Subject classification uses title keywords or the broad collection category. It may miss relevant material.
- DEF CON / creator-talk-panel / 2026
Beyond Theoretical Risk: How Cache Poisoning Escalated to Critical Account Takeover in TikTok’s Web Infrastructure
Glendon Chong · Issue/event 34
- DEF CON / main-track-talk / 2026
CRLF-Powered Desync Attacks: Beheading HTTP streams
Tom "t0xodile" Stacey, Tobia "mastersplinter" Righi · Issue/event 34
- DEF CON / main-track-talk / 2026
Can AI do novel security research? Meet the HTTP Terminator
James "albinowax" Kettle · Issue/event 34
- DEF CON / creator-talk-panel / 2026
CyberKB: When Your AI Copilot Runs the Recon, Crawls the Dark Web, and Maps the Kill Chain
Suriya Prasath S, Chandru J, Muthu Kumar · Issue/event 34
- DEF CON / creator-talk-panel / 2026
Dreamcast Ex Inferis: RCE on the Sega Dreamcast PlanetWeb Browser
Christopher "Piffd0s" Hernandez · Issue/event 34
- DEF CON / main-track-talk / 2026
From Fuzzer Noise to a Weaponized PHP Exploit: Exploiting a PHP Use-After-Free Vulnerability
Can Oztas, Kağan Çapar · Issue/event 34
- DEF CON / main-track-talk / 2026
Gotta Phish 'Em All! Novel Attack Techniques via Persistent Browser-in-the-Middle
Giacomo "GiacoLenzo2109" Lenzini · Issue/event 34
- DEF CON / creator-talk-panel / 2026
Man-in-the-Browser: Hijacking Javascript APIs for Browser Persistence and Credential Theft
Aarav Juneja · Issue/event 34
- DEF CON / creator-talk-panel / 2026
Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover
Stav Cohen · Issue/event 34
- DEF CON / main-track-talk / 2026
Taming the Swarm: Hard Architectural Lessons from Building a Deterministic Agentic Web Pentesting System
Albert "yz9yt" Corzo · Issue/event 34
- DEF CON / main-track-talk / 2026
The Stream Is Dead, Long Live the Stream: How HTTP/2 Lets Dead Streams Keep Servers Working
Gal Bar Nahum · Issue/event 34
- DEF CON / main-track-talk / 2025
Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen
Marek Tóth · Issue/event 33
- DEF CON / main-track-talk / 2025
ChromeAlone: Transforming a Browser into a C2 Platform
Michael "bouncyhat" Weber · Issue/event 33
- DEF CON / creator-talk-panel / 2025
Exploiting the Off-chain ecosystem in Web 3 Bug Bounty
Bruno "BrunoModificato" Halltari · Issue/event 33
- DEF CON / main-track-talk / 2025
Ghost Calls: Abusing Web Conferencing for Covert Command & Control
Adam "UNC1739" Crosser · Issue/event 33
- DEF CON / main-track-talk / 2025
HTTP/1.1 Must Die! The Desync Endgame
James "albinowax" Kettle · Issue/event 33
- DEF CON / main-track-talk / 2025
Kill List: Hacking an Assassination Site on the Dark Web
Carl Miller, Chris Monteiro · Issue/event 33
- DEF CON / creator-talk-panel / 2025
Plug and Prey: Scanning and Scoring Browser Extensions
Nishant Sharma, Shourya Pratap Singh · Issue/event 33
- DEF CON / creator-talk-panel / 2025
Robin: The Archaeologist of the Dark Web - Because Manual Dark Web OSINT is So Last Season
Apurv "ASG_Sc0rpi0n" Singh Gautam · Issue/event 33
- DEF CON / creator-talk-panel / 2025
Takes All Kinds: Building Onramps for Emergency Web Archiving in Ukraine and Beyond
Quinn Dombrowski · Issue/event 33
- DEF CON / creator-talk-panel / 2025
The Death of XSS? Browser Security Features that Eliminate Bug Classes
Javan Rasokat · Issue/event 33
- DEF CON / creator-talk-panel / 2025
enumeraite: AI assisted web attack surface enumeration
Özgün Kültekin · Issue/event 33
- Phrack / article / 2025
Guarding the PHP Temple
mr_me · Issue/event 72
- Phrack / article / 2025
The Art of PHP - My CTF Journey and Untold Stories!
Orange Tsai · Issue/event 72
- Phrack / article / 2021
Attacking JavaScript Engines: A case study of JavaScriptCore and CVE-2016-4622
saelo · Issue/event 70
- Phrack / article / 2021
Exploiting Logic Bugs in JavaScript JIT Engines
saelo · Issue/event 70
- Phrack / article / 1998
NT Web Technology Vulnerabilities
rfp · Issue/event 54