Top 10 web hacking techniques of 2025

Collection of PortSwigger Research posts (2024–2026) cataloguing novel web-exploitation techniques and tooling. Highlights include parser-level SAML authentication bypasses (Ruby/PHP ecosystems, unauthenticated admin on GitLab reported), HTTP/1.1 desynchronisation and request-smuggling attacks enabling large-scale takeover, cookie-prefix and HttpOnly bypasses, CSS-based data exfiltration, JWT forgery, WAF and URL-validation bypasses, cache exploitation, timing and race-condition attacks, WebSocket analysis tooling, and several AI-powered Burp extensions. The feed aggregates research and PoCs;