PortSwigger

This audio is presented by Hacker Noon, where anyone can learn anything about any technology.

PortSwigger Said Chrome Updates Broke Its CSRF Lab.

My Tests Tell a Different Story by RivenX173.

TLDR: On August eleventh, twenty twenty-six, I was one lab away from finishing PortSwigger's CSRF module when the final lab, Same-Site Lax Bypass Via Cookie Refresh, refused to start.

PortSwigger support told me recent Chrome updates to the victim browser had broken it, and within twenty-four hours, they had quietly removed both the lab and the theory section titled Bypassing Same-Site Lax Restrictions With Newly Issued Cookies from the Academy entirely.

I accepted that explanation for a while.

Then, weeks later, I went looking for any public record of Chrome actually removing this two-minute grace window and found nothing.

So I built a two-site Python proof of concept and tested it across eight Chrome versions to find out for myself whether the bypass still exists.

He also is a multiple time Black Hat and Def Con speaker, and even now as a senior security leader, he still spends his free time hacking and doing original research.

At Def Con 33, he introduced a new web attack class called Recursive Request Exploit, which was nominated for PortSwigger's Top 10 Web Hacking Techniques in 2025.

And this summer, he scanned a million domains and found more than 2,000 Firebase databases exposed to the internet.

So he spent two decades thinking like an attacker, breaking systems, and finding the things defenders missed.

You're one of those leaders that is actually still hacking, still doing hands-on research, all the jazz.

That's one of the reasons actually why I personally respect you and why I think you have such a big impact as a leader.

So your research uncovered a new web exploit class, RRE, or recursive request exploits, which was nominated for PortSwigger's Top 10 Web Hacking Techniques in 2025.

Congratulations.

This is the Risky Bulletin prepared by Catalin Cimpanu and read by me, Claire Aird.

Today is the 30th of September, and this podcast episode is brought to you by PortSwigger.

In today's top story, a suspected member of the Shiny Hunters hacking group has been arrested in the Netherlands.

24-year-old Pepijn Vanderstap was arrested on September 16.

[upbeat music] Hey, everyone.

I'm James Wilson, and welcome to this Risky Business sponsored interview with PortSwigger's Head of Marketing, Kieron Hughes, and Product Marketing Manager, Andrzej Matykiewicz.

In this interview, we're going to be talking about Burp AT.

That is the agentic way to drive the well-known and very popular Burp Suite pen testing tool.

So you can now give Burp and its agents, uh, an outcome, an objective that you're seeking.

It can use the full, uh, context of the, the project and the engagement, and it can then leverage Burp's tools to then go and take the actions.

So the, the benefit there is that it can really benefit from the, the methods and the skills that we've worked with our PortSwigger research team on, and obviously James Kettle is a, is a part of that.

Um, and you retain full kind of scope and permission control, and it all, all acts within, within Burp's boundaries.