Smashing the token limit with overlapping fragments
PortSwigger researchers show how overlapping fragments bypass token-size constraints, enabling exfiltration of larger secrets than previously demonstrated—relevant for teams relying on size-based input controls.
Summary written by editorial AI · Source link below
I'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in
Editorial Analysis
Size-based input assumptions underpin many web-application security controls; techniques that bypass them could expose session tokens and secrets thought to be too large to exfiltrate.
Review your web-application security controls for assumptions about maximum token or fragment sizes and test them against overlapping-fragment attack patterns.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at PortSwigger Research in a new tab.
More from the Research Desk
- Firecracker VM Escape: PwnEscape Part 23d
- A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow3d
- LABBA: LLM-Assisted Behavioral Biometric Authentication3d
- A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents3d
- KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels3d