Top 10 web hacking techniques of 2025
2026-08-04T08:51:47Z•0b2176ba78d62e6beddad793b235470945a7dd935a93b6cfdbc23e49d0d9a4ff
CSS-exfiltrationHTTP-desynchronizationIDORJWTSAMLSSRFURL-validationWAF-bypassXSSaccess-controlauthentication-bypassbrowser-securitycookie-securityopen-redirectparser-discrepancyrace-conditionrequest-smugglingsecurity-researchtoken-forgeryweb-application-securityweb-cache-poisoningweb-security
What happened
PortSwigger Research feed aggregating web security research and offensive testing techniques from 2023–2026. Topics include SAML authentication bypasses, HTTP desynchronization and request smuggling, cookie and WAF parser discrepancies, CSS and XSS data exfiltration, URL validation bypasses enabling SSRF and open redirects, cache poisoning, JWT and signed-token forgery, race conditions, access-control testing, and browser or protocol inconsistencies. The document describes research themes rather than a single confirmed vulnerability and does not provide specific CVE identifiers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 0b2176ba78d62e6beddad793b235470945a7dd935a93b6cfdbc23e49d0d9a4ff
- Enrichment time
- 2026-08-04T08:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.