Top 10 web hacking techniques of 2025
2026-07-15T20:51:53Z•586dd6a67ad264f2245fbd278cab764b800138cde6a1402776927d413dbfe818
AI-assisted-testingBurp-extensionsCORSCSS-exfiltrationHTTP-desyncHttpOnly-cookie-bypassJWT-forgerySAMLSSRFSignSaboteurTRACE-desyncURL-validation-bypassVSCode-exploitWAF-bypassWebSocket-testing__Host__Secureauthentication-bypasscache-exploitationcookie-prefix-bypasscookie-sandwichrequest-smugglingruby-samltiming-attacksunicode-overflow
What happened
Collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 index) summarising high-impact web-security research from 2024–2026. Highlights include full authentication bypasses in the SAML ecosystem (ruby-saml / PHP SAML) enabling unauthenticated admin access, large-scale HTTP desync/request-smuggling risks (HTTP/1.1 desync and TRACE-assisted desync), cookie defenses bypasses (including __Host/__Secure prefix bypasses and an HttpOnly cookie "cookie sandwich" technique), JWT signing abuse (SignSaboteur), CSS-based data exfiltration, URL validation/WAF bypasses, and multiple new
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 586dd6a67ad264f2245fbd278cab764b800138cde6a1402776927d413dbfe818
- Enrichment time
- 2026-07-15T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.