James Kettle Research Overview

147 |

Upcoming Presentations

148 |

149 | None right now! 150 | 151 |

152 | Show/Hide past presentations 153 | Show/Hide past presentations 154 |

155 |

Past presentations

156 |

BlackHat USA 2017 - Cracking the Lens: Targeting HTTP's Hidden Attack-Surface
PHDays 7 - Backslash Powered Scanner: Automating Human Intuition
NorthSec 2017 - Backslash Powered Scanner: Automating Human Intuition
AppSec EU 2017 - Exploiting CORS Misconfigurations for Bitcoins and Bounties
AppSec USA 2016 - Exploiting CORS Misconfigurations for Bitcoins and Bounties
BlackHat EU 2016 - Backslash Powered Scanner: Hunting Unknown Vulnerabilities
44Con 2015 - Hunting Asynchronous Vulnerabilities
BlackHat USA 2015 - Server-Side Template Injection: RCE for the Modern Web App
OWASP AppSec EU 2014 - ActiveScan++: Augmenting manual testing with attack proxy plugins

167 |

168 |

169 |
170 |

171 |

172 |

Attack Technique Research

173 |

Cracking the Lens: Targeting HTTP's Hidden Attack-Surface (recording)
Exploiting CORS Misconfigurations for Bitcoins and Bounties (recording)
Server-Side Template Injection (recording)
CSV Formula Injection
Practical HTTP Host header attacks

180 |

181 | 182 |

183 |

Automation Research

184 |

Backslash Powered Scanner: Automating Human Intuition (recording)
Hunting Asynchronous Vulnerabilities (recording)
ActiveScan++ (recording)

189 |
190 |

191 |

192 |

193 |

194 |

Misc

195 |

2018-01-26 - h1-212 Video Interview
2017-11-23 - h1-212 CTF Writeup
2017-11-08 - hackxor2 (web application hacking game)
2017-10-06 - When Security Features Collide
2017-09-05 - Interview with Bug Bounty Forum
2017-08-23 - Adapting Burp Extensions for Bespoke Pentesting
2017-08-21 - How I Accidentally Framed Myself
2017-04-24 - Abusing OWASP with 'Insufficient Attack Protection'
2017-01-18 - Interview with HackerOne about PortSwigger's bug bounty
2016-08-11 - Reviewing bug bounties - a hacker's perspective
2016-05-31 - Web Storage: the lesser evil for session tokens
2016-04-25 - Adapting AngularJS Payloads to Exploit Real World Applications (With Gareth Heyes)
2015-02-17 - Detecting and exploiting path-relative stylesheet import (PRSSI) vulnerabilities (aka RPO)
2012-06-02 - X-Frame-Options Gotcha
2011-12-20 - Phrack ebook
2011-03-25 - hackxor web application hacking game

213 |

214 |

whoami

215 |

216 | I'm the Head of Research at PortSwigger Web Security, where I design and refine vulnerability detection techniques for Burp Suite's scanner, and research novel attack techniques. 217 |

218 | Show/Hide full bio 219 | Show/Hide full bio 220 |

221 |
222 | James Kettle is Head of Research at PortSwigger Web Security, where he designs and refines vulnerability detection techniques for Burp Suite's scanner. Recent work has focused on techniques to detect unknown classes of vulnerabilities, and exploiting subtle CORS misconfigurations in bitcoin exchanges. James has extensive experience cultivating novel attack techniques, including server-side RCE via Template Injection, client-side RCE via malicious formulas in CSV exports, and abusing the HTTP Host header to poison password reset emails and server-side caches. He has spoken at numerous prestigious venues including both BlackHat USA and EU, and OWASP AppSec USA and EU. 223 |

224 |

225 | 226 | 227 |