Top 10 web hacking techniques of 2025
2026-05-29T08:51:54Z•830631fee5cd36883472b58eda5f1e8e41e5cca5af85a20d8f496ec870d7adda
authentication-bypassburp-extensionscache-poisoningcookie-prefix-bypasscss-exfiltrationhttp-desynchttponly-cookie-theftjwt-forgeryparser-discrepanciesrequest-smugglingsamltiming-attackswaf-bypassweb-securitywebsocket-testing
What happened
Collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 and related publications) highlighting multiple high-impact web-security techniques and proof-of-concept exploits. Key topics include parser-level SAML authentication bypasses (full auth/admin bypasses in ruby/php SAML libraries), HTTP/1.1 desync and request-smuggling exploitation (hostile takeover vectors and new TRACE-assisted exploit techniques), cookie defenses bypasses (__Host/__Secure prefix and HttpOnly via "cookie sandwich"), CSS-based data exfiltration (inline-style chained conditionals), WebSocket fuzzing/ex
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 830631fee5cd36883472b58eda5f1e8e41e5cca5af85a20d8f496ec870d7adda
- Enrichment time
- 2026-05-29T08:51:54Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.