Top 10 web hacking techniques of 2025
2026-04-10T20:52:01Z•2c67bfcb633605e2c8340e59ae4b6c277f27be7ac143058f42b65030ad123812
Burp SuiteCSP bypassCSS exfiltrationHTTP desyncHttpOnlyJWTSAMLWAF bypassWebSocketXSSauthentication bypasscache poisoningcookie bypasscookie-prefixportSwiggerrequest smugglingresearch rounduptiming attackstoolingweb security
What happened
Aggregation of PortSwigger Research publications (2023–2026), highlighting major web-security research and tooling. Key items include: full authentication bypass techniques against Ruby/PHP SAML libraries (parser/namespace confusion and attribute pollution); a broad push on HTTP desync/request-smuggling issues (including TRACE-assisted exploitation and desync endgame analysis); cookie and HttpOnly bypass techniques (cookie-prefix and "cookie sandwich" attacks); CSS-based exfiltration and blind CSS techniques; WebSocket fuzzing/exploitation tooling; JWT forging tooling (SignSaboteur); CSP/form‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 2c67bfcb633605e2c8340e59ae4b6c277f27be7ac143058f42b65030ad123812
- Enrichment time
- 2026-04-10T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.