Top 10 web hacking techniques of 2025
2026-04-14T20:51:57Z•3d25c9baf0fe3e72d54212c4c19f972296549995df3a6593e91e279af3100b17
__Host-__Secureauthentication-bypassbambdascache-poisoningcookie-prefix-bypasscookie-sandwichcss-exfiltrationhttp-desynchttp-request-smugglinghttponly-cookie-bypassinline-style-exfiltrationjwtphantom-$Versionportswiggerrequest-smugglingresearchsamlsaml-bypasssignsaboteur','jwt-forgery','jwt-exploitation','xss','xss-cheat‑trace-methodturbo-intruderwaf-bypassweb-cache-exploitationweb-securitywebsocket-testing
What happened
Collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 and related publications) summarising numerous modern web‑security research items and exploitation techniques. Notable topics include parser‑level SAML authentication bypasses (Ruby/PHP) enabling full auth bypass and GitLab exploitation, HTTP/1.1 desync and request‑smuggling analysis and new exploitation techniques (TRACE, desync endgame, distinguishing pipelining vs smuggling), cookie prefix and HttpOnly bypass techniques (cookie sandwich, phantom $Version cookie), CSS and inline style data exfiltration, WebSocket‑or
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 3d25c9baf0fe3e72d54212c4c19f972296549995df3a6593e91e279af3100b17
- Enrichment time
- 2026-04-14T20:51:57Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.