Top 10 web hacking techniques of 2025
2026-03-25T20:51:58Z•7773520574e79b12f2f9dd00f817777709062068acaa43cc808462e1259d0b91
cache-exploitationcookiescss-exfiltrationexploit-techniqueshttp-desynchttponlyjwtport-swiggerrace-conditionsrequest-smugglingresearchsamlunicode-overflowwaf-bypassweb-application-securitywebsocket
What happened
PortSwigger Research published a large collection of web-security investigations and tooling updates (including the "Top 10 Web Hacking Techniques of 2025" roundup). Notable items include parser-level SAML authentication bypasses ("The Fragile Lock" / "SAML roulette") leading to full authentication/unauthenticated admin access in some Ruby/PHP SAML ecosystems and GitLab Enterprise; a broad analysis and exploitation roadmap for HTTP/1.1 desync attacks ("HTTP/1.1 must die"), plus new desync exploitation techniques (including TRACE-based methods); cookie defense bypasses (cookie-prefix and "phant
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 7773520574e79b12f2f9dd00f817777709062068acaa43cc808462e1259d0b91
- Enrichment time
- 2026-03-25T20:51:58Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.