Top 10 web hacking techniques of 2025
2026-07-01T20:51:54Z•201cab19f166f9857d5cfd345df7812f7aa729eaa124a0e8f7fa6a19bbfee55d
Burp extensionsCSP bypassCSS exfiltrationHTTP desyncHTTP request smugglingHttpOnly bypassJWT forgerySAMLURL validation bypassUnicode overflow attacksWAF bypassWebSocket fuzzing/exploitation__Host and __Secure prefixesauthentication bypasscache poisoningcookie securityresearch rounduptiming attackstooling/automationweb security
What happened
Feed of PortSwigger Research publications (2023–2026) summarising multiple high-impact web security research posts and tooling. Notable topics include parser-level SAML authentication bypasses (full auth bypasses in Ruby/PHP ecosystems and GitLab via ruby-saml), HTTP request desynchronisation/desync attacks and exploitation techniques (including TRACE-assisted desync and an "HTTP/1.1 must die" analysis), cookie-prefix and HttpOnly bypass techniques ("Cookie Chaos", "cookie sandwich"), CSS-based data exfiltration (inline-style and blind CSS techniques), JWT forgery tooling (SignSaboteur), URL/α
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 201cab19f166f9857d5cfd345df7812f7aa729eaa124a0e8f7fa6a19bbfee55d
- Enrichment time
- 2026-07-01T20:51:54Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.