Top 10 web hacking techniques of 2025
2026-07-24T20:51:54Z•2a4d09d218bb8710b5d76598270ca52bd77aeec075e40427c0d16cb7a78978c9
CORS misconfiguration','cache poisoning','single-packet race','rCSS exfiltrationGitLabHTTP desyncHttpOnly bypassJWT forgerySAMLSSRFSignSaboteurTRACETurbo IntruderURL validation bypassWAF bypassWebSocket fuzzing__Host__Secureauthentication bypasscookie sandwichcookie-prefix bypassinline-style exfiltrationnamespace confusionparser discrepanciesphantom $Version cookierequest smugglingruby-saml
What happened
A collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 + related articles) highlighting a broad set of high-impact web-security findings from 2024–2026. Key research includes parser- and namespace-level SAML flaws ("The Fragile Lock" and "SAML roulette") that enable full authentication bypasses and unauthenticated admin access (ruby-saml / GitLab vectors); multiple HTTP desynchronisation/request-smuggling advances (including HTTP/1.1 desync and TRACE-assisted exploitation) that enable takeover and cache/exploitation primitives; cookie-parser discrepancies allowing __Hot
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 2a4d09d218bb8710b5d76598270ca52bd77aeec075e40427c0d16cb7a78978c9
- Enrichment time
- 2026-07-24T20:51:54Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.