Top 10 web hacking techniques of 2025
2026-05-19T20:51:59Z•0d30b9e937651135a5346c4ceac17c405b8b1c2fba12ca4821f56efa8f8f4c6a
Burp-extensions (AI)CSS-exfiltrationHTTP-desyncHttpOnly-bypassJWT-forgeryPDF-rendering-discrepanciesSAMLSignSaboteurTRACE-desyncTurbo-IntruderURL-validation-bypassVSCode-exploitWAF-bypassWebSocket-security__Host__Secureattribute-pollutionauthentication-bypasscache-exploitationcookie-prefix-bypasscookie-sandwichnamespace-confusionrequest-smugglingruby-samltiming-attacks
What happened
PortSwigger Research published a collection of web-security research and tooling from 2024–2026, highlighted by their "Top 10 Web Hacking Techniques of 2025" roundup and multiple high-impact technical writeups. Notable findings include parser-level SAML weaknesses (attribute pollution, namespace confusion) leading to full authentication bypasses in Ruby/PHP SAML ecosystems (chainable to unauthenticated admin access on GitLab Enterprise), extensive analysis and exploitation techniques for HTTP desync/request smuggling (including TRACE-based exploitation and an "HTTP/1.1 must die" desync endgame
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 0d30b9e937651135a5346c4ceac17c405b8b1c2fba12ca4821f56efa8f8f4c6a
- Enrichment time
- 2026-05-19T20:51:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.