Top 10 web hacking techniques of 2025
2026-07-03T20:51:52Z•3160b5451bc0f967c416839f05d72170ae483c44677ad26a5c5d325b905eaa61
Burp-extensionsCSS-exfiltrationHTTP-desynchronisationHTTP-request-smugglingHttpOnlyJWT-forgerySAMLWAF-bypassWebSocket__Host__Secureauthentication-bypasscache-poisoningcookiesrace-conditionsresearch-collectiontoolingweb-application-security
What happened
A collection of PortSwigger Research publications (2024–2026) including the Top 10 Web Hacking Techniques of 2025 and multiple deep-dive research posts. Notable topics include parser-level SAML inconsistencies that enable full authentication bypasses in Ruby/PHP ecosystems (The Fragile Lock, SAML roulette), HTTP desynchronisation/request smuggling and exploitation techniques (HTTP/1.1 must die, TRACE desync), cookie-based attacks (bypassing __Host/__Secure prefixes, cookie-sandwich HttpOnly bypass, phantom $Version WAF bypass), CSS-based data exfiltration, WebSocket fuzzing/exploitation tools,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 3160b5451bc0f967c416839f05d72170ae483c44677ad26a5c5d325b905eaa61
- Enrichment time
- 2026-07-03T20:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.