Top 10 web hacking techniques of 2025
2026-05-21T20:51:52Z•642e4cbf9a5d879c6b7c5df3c992be64064ee719ccef7442a12e10f7aea31043
CSS exfiltrationHTTP desyncHTTP/1.1HttpOnly-bypassJWT forgingSAMLSSRFSignSaboteurURL validation bypassWAF bypassWebSocketXSSauthentication bypasscache poisoningcookie-prefix-bypasscookie-sandwichportswiggerrequest smugglingresearchtiming attackstoolingweb security
What happened
Collection of PortSwigger Research posts (including the Top 10 Web Hacking Techniques of 2025 and related publications) that detail numerous practical web-exploitation techniques and tooling published 2024–2026. Highlights include parser-level SAML inconsistencies that enable full authentication bypasses in Ruby/PHP (The Fragile Lock, SAML roulette), HTTP/1.1 desynchronisation/desync exploitation ("HTTP/1.1 must die", TRACE desync), cookie-prefix and HttpOnly bypass techniques (Cookie Chaos; Cookie Sandwich), guidance on distinguishing HTTP pipelining from request smuggling, new WebSocket fuzz
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 642e4cbf9a5d879c6b7c5df3c992be64064ee719ccef7442a12e10f7aea31043
- Enrichment time
- 2026-05-21T20:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.