PortSwigger Research portswigger.net

Top 10 web hacking techniques of 2025

portswigger.net·15w

Top 10 web hacking techniques of 2025: call for nominations

portswigger.net·19w

Introducing HTTP Anomaly Rank

portswigger.net·27w

The Fragile Lock: Novel Bypasses For SAML Authentication

portswigger.net·27w

WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine

portswigger.net·35w

WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine

portswigger.net·35w

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

portswigger.net·37w·Lobsters, Hacker News, r/programming

Inline Style Exfiltration: leaking data with chained CSS conditionals

portswigger.net·38w·DEV, Hacker News

Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling

portswigger.net·39w

HTTP/1.1 must die: the desync endgame

portswigger.net·41w·Lobsters, Hacker News, Hacker News, r/programming

Repeater Strike: manual testing, amplified

portswigger.net·44w

Drag and Pwnd: Leverage ASCII characters to exploit VS Code

portswigger.net·55w·Hacker News

Document My Pentest: you hack, the AI writes it up!

portswigger.net·56w

SAML roulette: the hacker always wins

portswigger.net·61w

Shadow Repeater:AI-enhanced manual testing

portswigger.net·65w

Top web hacking techniques of 2024

portswigger.net·67w·Hacker News

Bypassing character blocklists with unicode overflows

portswigger.net·68w

Stealing HttpOnly cookies with the cookie sandwich technique

portswigger.net·69w·Lobsters, Hacker News

Top 10 web hacking techniques of 2024: nominations open

portswigger.net·71w

Bypassing WAFs with the phantom $Version cookie

portswigger.net·76w

Log in to enable infinite scrolling