Top 10 web hacking techniques of 2025
2026-06-04T20:51:56Z•7c0a61b107fa4297566120b6fbed9b251542200333abe7f5e88c11983b777269
AI-assisted-testingBurp-extensionsCSS-exfiltrationHTTP-desyncHTTP/1.1HttpOnly-bypassJWTSAMLSSRFTRACEWAF-bypassWebSocketXSS__Host-prefix__Secure-prefixauthentication-bypasscache-exploitationcookiesphp-samlrequest-smugglingruby-samltiming-attackstoken-forgerytoolingweb-security
What happened
Collection of PortSwigger Research publications (2024–2026) summarizing numerous modern web-exploitation techniques and tooling. Highlights include parser-level SAML inconsistencies that enable full authentication bypasses (Ruby/PHP SAML ecosystems, chained namespace/attribute attacks leading to unauthenticated admin access on affected deployments), pervasive HTTP desynchronisation (HTTP/1.1 desync/request smuggling) exploitation techniques and new TRACE-based desync primitives, cookie-prefix and HttpOnly bypass techniques, CSS-based data-exfiltration methods, JWT/signed-token forging tooling,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 7c0a61b107fa4297566120b6fbed9b251542200333abe7f5e88c11983b777269
- Enrichment time
- 2026-06-04T20:51:56Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.