Top 10 web hacking techniques of 2025
2026-03-04T21:28:08Z•4d6bd067bfb359edb592cff8624cab12607f0b5742907a10c7e53bd9796c987e
Burp SuiteCSS exfiltrationHTTP desyncHttpOnly bypassJWT forgerySAMLSignSaboteurWAF bypassWebSocketXSSauthentication bypasscache poisoningcookie prefix bypassexploit techniquerace conditionsrequest smugglingresearchruby-samltiming attackstoolingweb security
What happened
Collection of PortSwigger Research posts (2023–2026) highlighting numerous high-impact web application attack techniques and tooling. Notable findings include parser-level SAML inconsistencies enabling full authentication bypasses in Ruby/PHP SAML ecosystems (and chained attacks against GitLab via ruby-saml), HTTP/1.1 desynchronisation (desync) and request smuggling exploitation guidance, techniques for bypassing __Host/__Secure cookie prefixes and HttpOnly protections (cookie-sandwich / phantom $Version cookie), CSS-based exfiltration and blind-CSS attacks, novel WebSocket fuzzing/exploration
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 4d6bd067bfb359edb592cff8624cab12607f0b5742907a10c7e53bd9796c987e
- Enrichment time
- 2026-03-04T21:28:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.