Top 10 web hacking techniques of 2025
2026-06-08T20:51:53Z•7189c39d4721906bcab8c90610d7e9cd0482799b9cd7857bdfd615bf0bae63f7
HttpOnly-bypassJWT-forgerySAML__Host__Secureauthentication-bypassburp-extensionscache-exploitationcookie-bypasscss-exfiltrationhttp-desyncjwtrepeater-strikerequest-smugglingresearch-collectionshadow-repeatersignsaboteurtiming-attackstrace-desyncturbo-intruderurl-validation-bypasswaf-bypassweb-securitywebsocket-testingxss
What happened
Collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 and related publications) summarizing numerous high-impact web-security findings and tooling from 2023–2025. Notable technical highlights include parser-level SAML authentication bypasses (Ruby/PHP) enabling unauthenticated admin access on affected deployments, multiple HTTP desynchronisation/desync and request-smuggling exploitation techniques (including TRACE-based exploitation and HTTP/1.1 desync analysis), cookie-parser discrepancies enabling bypasses of __Host/__Secure prefixes and HttpOnly protections (cookie-s
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 7189c39d4721906bcab8c90610d7e9cd0482799b9cd7857bdfd615bf0bae63f7
- Enrichment time
- 2026-06-08T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.