Top 10 web hacking techniques of 2025
2026-07-22T20:52:00Z•96c16adcb74c57c6cc63563a1bac6f27458ab19288ffa2ff572d7f22d7fb06be
Burp-extensionsCSS-exfiltrationHTTP desyncHTTP/1.1HttpOnly-bypassJWT-forgerySAMLSignSaboteurWAF-bypassWebSocket-exploitation__Host-prefix__Secure-prefixauthentication-bypasscache-poisoningcookie-parser-vulnerabilitiesexploit-techniquesprotocol-desyncrace-conditionsrequest smugglingresearchsecurity-toolstiming-attacksweb-security
What happened
PortSwigger Research feed (2024–2026) aggregating high-impact web-security research and tools. Key themes include parser and protocol discrepancies (SAML namespace/attribute pollution enabling full auth bypasses in Ruby/PHP), HTTP desynchronisation/request-smuggling and an argument that HTTP/1.1 is inherently unsafe, cookie-parser attacks (bypassing __Host/__Secure prefixes and HttpOnly via 'cookie sandwich' and phantom $Version techniques), JWT signing forgery (SignSaboteur), CSS-based data exfiltration, WebSocket analysis and exploitation, cache- and WAF-bypass techniques, timing and race‑or
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 96c16adcb74c57c6cc63563a1bac6f27458ab19288ffa2ff572d7f22d7fb06be
- Enrichment time
- 2026-07-22T20:52:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.