Top 10 web hacking techniques of 2025
2026-03-04T21:28:22Z•dadba5226f1462556c56e3cf601e056ac27930210fe0cba19d74404b42c34ead
ai-extensionsauthentication-bypassburp-suitecookie-prefix-bypasscss-exfiltrationexploit-toolinghttp-desynchttp/1.1httponly-cookie-theftjwt-forgerypdf-rendering-discrepanciesportswiggerrace-conditionsrequest-smugglingsamlsignsaboteurtrace-methodunicode-overflowweb-securitywebsocket
What happened
Collection of PortSwigger Research posts (Top 10 Web Hacking Techniques 2025 and related publications) detailing multiple high-impact web security research topics from 2024–2025. Notable findings include parser-level SAML inconsistencies enabling full authentication bypasses in Ruby/PHP SAML libraries (unauthenticated admin access demonstrated), HTTP/1.1 desynchronisation (desync) and request-smuggling exploitation techniques, bypasses for __Host/__Secure cookie prefixes and techniques to steal HttpOnly cookies, CSS-based data exfiltration, WebSocket analysis and tooling, JWT forgery tooling (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- dadba5226f1462556c56e3cf601e056ac27930210fe0cba19d74404b42c34ead
- Enrichment time
- 2026-03-04T21:28:22Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.