Top 10 web hacking techniques of 2025
2026-07-23T08:51:58Z•ecd0fd0597d6f3cbc465dfdc80857898c3990cb279ca4da32e14b6f89fb23588
AI-assisted testingBurp SuiteCSS exfiltrationGitLabHTTP desyncHttpOnly cookie theftJWT forgeryRepeater StrikeSAMLSignSaboteurURL validation bypassWebSocket testing__Host__Secureauthentication bypasscache poisoningcookie prefix bypasscookie sandwichinline style exfiltrationphp-samlrequest smugglingresearch roundupruby-samltoolingweb security
What happened
Collection of PortSwigger Research publications (Top 10 web hacking techniques and related posts from 2024–2026) describing a range of novel web‑security techniques and tool releases. Key findings include parser‑level SAML inconsistencies that enable full authentication bypasses in Ruby and PHP SAML ecosystems (chained namespace/confusion and attribute pollution; demonstrated against GitLab Enterprise), large‑scale HTTP/1.1 desynchronisation (desync/request smuggling) risks enabling takeover, new techniques to bypass cookie protections (__Host / __Secure prefixes and HttpOnly via the “cookie‑s
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- ecd0fd0597d6f3cbc465dfdc80857898c3990cb279ca4da32e14b6f89fb23588
- Enrichment time
- 2026-07-23T08:51:58Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.