Top 10 web hacking techniques of 2025
2026-05-07T20:52:08Z•762bbe992684d1d29b64c50850c443b502f60a61084e3331266f52f1571d10ad
authentication-bypasscache-poisoning','timing-attacks','pdf-rendering-discrepancies'cookie-prefix-bypasscookie-sandwichcookiescss-exfiltrationhttp-anomaly-detectionhttp-desynchttponly-bypassinline-style-exfiltrationjwtjwt-forgeryphp-samlportswigger-researchrequest-smugglingruby-samlsamlsignsaboteurtrace-desyncunicode-overflowurl-validation-bypassweb-securitywebsocket-fuzzingwebsocket-securityxss
What happened
A PortSwigger Research collection (2024–2026) describing numerous high-impact web security findings and tooling. Key issues include parser-level SAML inconsistencies (attribute pollution, namespace confusion) that enable full authentication bypasses in ruby‑saml and php‑saml (chainable to unauthenticated admin access in at least one case), widespread HTTP desynchronisation/desync and request‑smuggling exploitation vectors (including new TRACE-based techniques) that can lead to site takeover, several cookie parser attacks (cookie‑sandwich, phantom $Version and methods to bypass __Host/__Secure/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 762bbe992684d1d29b64c50850c443b502f60a61084e3331266f52f1571d10ad
- Enrichment time
- 2026-05-07T20:52:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.