Top 10 web hacking techniques of 2025
2026-07-06T20:51:57Z•f2c08b3470555d2242c173a07ce37be149716d86b14a6e68ae3f5eb93341c41a
AI extensionsBurp SuiteCSS exfiltrationHTTP desyncHTTP/2HttpOnly bypassJWTSAMLURL validation bypassWAF bypassWebSocketauthentication bypasscache poisoningcookie-prefixescookiesrace conditionsrequest smugglingtoken forgerytoolingweb security
What happened
Collection of PortSwigger Research posts (2023–2026) covering novel and practical web-security techniques and tools. Key findings include parser-level SAML inconsistencies enabling full authentication bypasses (Ruby/PHP ecosystems, GitLab impact), large-scale HTTP desync/desynchronisation exploitation techniques, request-smuggling analysis, cookie-prefix and HttpOnly bypasses, CSS-based data exfiltration, WebSocket testing improvements, JWT signing/forgery tooling, cache and URL-validation abuse, WAF evasion via phantom $Version cookie, Unicode truncation/overflow attacks, and several race/tim
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- f2c08b3470555d2242c173a07ce37be149716d86b14a6e68ae3f5eb93341c41a
- Enrichment time
- 2026-07-06T20:51:57Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.