Top 10 web hacking techniques of 2025
2026-07-16T20:52:00Z•6bbf2754d824a737657b6d9d1056d5c921c8dd71c260b689a41fe42f0d46663a
__host__secureauthentication bypasscache poisoningcookie prefix bypasscookie-sandwichcsp bypasscss exfiltrationform hijackinghttp desynchttponly cookie theftinline style exfiltrationjwt forgeryparser inconsistenciesportswiggerrequest smugglingsamlsignsaboteurssrftiming attackstrace desyncunicode overflowweb securitywebsocket testingxss
What happened
Collection of PortSwigger Research publications and the 2025 “Top 10 Web Hacking Techniques” roundup. Highlights include practical, high-impact findings such as parser-level SAML inconsistencies leading to full authentication bypasses in Ruby/PHP SAML libraries, HTTP/1.1 desync (request smuggling/desync exploitation) and new TRACE-assisted desync techniques, methods to bypass cookie prefixes (__Host / __Secure) and steal HttpOnly cookies (cookie-sandwich), CSS-based data exfiltration (inline-style and blind CSS), JWT/signing forgery tooling (SignSaboteur), WebSocket-focused large-scale testing
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 6bbf2754d824a737657b6d9d1056d5c921c8dd71c260b689a41fe42f0d46663a
- Enrichment time
- 2026-07-16T20:52:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.