Top 10 web hacking techniques of 2025
2026-03-09T20:52:06Z•97d5212536d79e53e8a6c3d2dc8ee25114a43dba4ca4dfae0bef369ca6c8fbf1
SAMLai-assisted-testingauthentication-bypassburp-extensionscache-exploitationcookie-prefix-bypasscss-exfiltrationhttp-desynchttponly-bypassjwt-forgerynamespace-confusionparser-discrepancypdf-rendering-discrepanciesrace-conditionsrequest-smugglingtiming-attackstoolingwaf-bypassweb-securitywebsocket-security
What happened
Collection of PortSwigger Research posts (2024–2026) describing numerous novel web-security techniques and tooling. Highlights include parser-level SAML inconsistencies that enable full authentication bypasses in Ruby/PHP SAML stacks and GitLab, HTTP/1.1 desync and request-smuggling exploitation techniques, cookie-prefix and HttpOnly bypass methods, CSS-based data exfiltration, WebSocket analysis and exploitation, JWT forging (SignSaboteur), cache exploitation, timing and race-condition attacks, browser rendering discrepancies (PDFs), and new Burp AI/automation extensions (Repeater Strike, Re‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 97d5212536d79e53e8a6c3d2dc8ee25114a43dba4ca4dfae0bef369ca6c8fbf1
- Enrichment time
- 2026-03-09T20:52:06Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.