Top 10 web hacking techniques of 2025
2026-03-11T20:52:03Z•99b3649db3af3c751d05464cc60186700448cfb6c9bcb917552b8cd64891aba3
ai-assisted-testingauthentication-bypassburp-extensionscache-poisoningcookie-prefix-bypasscss-exfiltrationexploit-toolinggitlabhttp-desynchttponly-cookie-theftinline-style-exfiltrationjwt-forgerypdf-rendering-discrepanciesrequest-smugglingruby-samlsamlsignsaboteurtiming-attackstrace-methodurl-validation-bypasswaf-bypasswebsocketxss
What happened
Collection of PortSwigger Research posts (2024–2026) detailing multiple high-impact web security findings and tooling: parser-level SAML authentication bypasses (including ruby-saml chains leading to unauthenticated admin access on GitLab), large-scale HTTP desynchronisation/request-smuggling techniques (including TRACE-assisted exploitation and an “HTTP/1.1 desync endgame”), cookie-prefix and HttpOnly bypasses (cookie-sandwich / phantom $Version attacks), CSS/inline-style exfiltration techniques, JWT forging tooling (SignSaboteur), WebSocket-focused fuzzing/exploitation, cache and URL‑parsing
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 99b3649db3af3c751d05464cc60186700448cfb6c9bcb917552b8cd64891aba3
- Enrichment time
- 2026-03-11T20:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.