Top 10 web hacking techniques of 2025
2026-03-27T20:51:53Z•139151458bfe02c314675811d98aebd3a03aa842b9ed7637581183e77b80a4f1
Burp extensionsCSP bypassCSS exfiltrationHTTP desyncHttpOnly cookie theftJWT forgerySAMLSSRFSignSaboteurWAF bypassWebSocket testingXSSauthentication bypasscache exploitationcookie bypassdesync exploitationrequest smugglingtiming attacksturbo intruderweb security
What happened
Collection of PortSwigger Research posts (2024–2026) highlighting notable web-security techniques and tools. Key items include the Top 10 Web Hacking Techniques of 2025, multiple SAML parser/namespace confusion findings that enable full authentication bypasses (Ruby/PHP ecosystems and a GitLab Enterprise attack), serious HTTP-layer issues (HTTP/1.1 desync and request-smuggling distinctions, TRACE-aided desync exploitation), cookie parser/prefix bypasses (including techniques to defeat __Host/__Secure and steal HttpOnly cookies via a “cookie sandwich”), novel exfiltration methods (CSS/inline‑/盲
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 139151458bfe02c314675811d98aebd3a03aa842b9ed7637581183e77b80a4f1
- Enrichment time
- 2026-03-27T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.