Top 10 web hacking techniques of 2025
2026-06-15T20:51:58Z•ab75da3af10efd61a229aead16dce727007ddc57b7829a7b94de2b4cef45c211
CSS-exfiltrationHTTP-desyncHttpOnly-bypassJWTSAMLWebSocket-testing__Host-__Secureauthentication-bypasscache-exploitationcookie-securitynamespace-confusionparser-discrepanciesrequest-smugglingtoken-forgeryweb-security
What happened
Collection of PortSwigger Research posts (2024–2026) highlighting high-risk web security techniques and new exploitation methods. Notable research includes multiple SAML parser-level inconsistencies (attribute pollution, namespace confusion) that enable full authentication bypasses in Ruby/PHP SAML ecosystems and an unauthenticated admin takeover chain against GitLab Enterprise; systemic HTTP/1.1 desynchronisation (desync/request-smuggling) attack techniques that can lead to takeover; cookie-parser and prefix bypasses (including __Host/__Secure and HttpOnly bypasses); novel exfiltration and X‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- ab75da3af10efd61a229aead16dce727007ddc57b7829a7b94de2b4cef45c211
- Enrichment time
- 2026-06-15T20:51:58Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.