Top 10 web hacking techniques of 2025
2026-05-22T20:51:54Z•95d8a81970f1e661ab738490a557de85f2f7c99370ea8f00c13f2ded52aae6f7
authentication-bypassburp-extensionscache-poisoningcookie-prefix-bypasscss-exfiltrationhttp-desynchttponly-bypassjwt-forgeryrace-conditionsrequest-smugglingsaml-bypassssrf/url-validation-bypasstiming-attackstoolingunicode-overflowwaf-bypasswebsocket-testing
What happened
A collection of PortSwigger Research posts (2024–2026) detailing multiple high-impact web-security discoveries and new offensive tooling. Notable disclosures include parser-level SAML inconsistencies that enable full authentication bypasses (Ruby/PHP ecosystems, chained namespace/round‑trip attacks and an unauthenticated admin compromise on GitLab Enterprise), widespread HTTP/1.1 desync issues enabling site takeover and request-smuggling exploitation, several cookie-parser flaws (bypassing __Host/__Secure prefixes and an HttpOnly cookie‑theft “cookie sandwich”), WAF bypass techniques, CSS and
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 95d8a81970f1e661ab738490a557de85f2f7c99370ea8f00c13f2ded52aae6f7
- Enrichment time
- 2026-05-22T20:51:54Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.