Top 10 web hacking techniques of 2025
2026-03-16T08:52:00Z•05038adcb4c18ca03704865dd06039ff24aeb46eca12f6ff8ba22aa98c43c9a1
CSP-bypassCSS-exfiltrationHTTP-desynchronisationHttpOnly-cookie-theftJWT-forgerySAMLURL-validation-bypassWAF-bypassWebSocketXSSauthentication-bypasscache-poisoningcookie-prefix-bypassportswigger-researchrace-conditionrequest-smugglingsecurity-toolingtiming-attacksunicode-overflowweb-security
What happened
Feed of PortSwigger Research publications (2023–2026) highlighting numerous high-impact web-security findings and tooling. Notable themes include parser-level SAML flaws enabling full authentication bypasses in Ruby/PHP SAML, widespread HTTP/1.1 desynchronisation and request-smuggling/desync exploitation techniques that can enable site takeover, cookie and HttpOnly bypass techniques (cookie-prefix and "cookie sandwich"), CSS-based data exfiltration, JWT forgery tooling (SignSaboteur), URL validation and WAF bypasses, cache exploitation, race- and timing-attacks (including single-packet attacks
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 05038adcb4c18ca03704865dd06039ff24aeb46eca12f6ff8ba22aa98c43c9a1
- Enrichment time
- 2026-03-16T08:52:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.