Notifications
Clear all
Topic starter
01/08/2026 10:45 pm
TL;DR: Researchers are converging on parser differentials, cache poisoning, Unicode normalization, SSRF visibility, ORM leakage, and error-based code injection, according to PortSwigger’s Top 10 Web Hacking Techniques of 2025, with 63 nominations this year and a final ten chosen by community vote and expert panel. The pattern matters because modern web defence still assumes clean parsing, stable trust boundaries, and predictable server behaviour, all of which these techniques continue to erode.
NHIMG editorial — based on content published by PortSwigger: Top 10 web hacking techniques of 2025
By the numbers:
- The community nominated 63 pieces of research as contenders, which is significantly fewer than the 121 submissions last time.
- The final list was selected from 15 community-voted finalists by an expert panel.
Questions worth separating out
Q: How should security teams test for parser differentials in web applications?
A: Test the full request path, not just the application endpoint.
Q: Why do side channels still matter in modern web security?
A: Side channels matter because attackers can learn from timing, cache state, response length, or redirect behaviour even when direct content is protected.
Q: What do security teams get wrong about Unicode normalization attacks?
A: Teams often treat Unicode as a display problem rather than a security boundary.
Practitioner guidance
- Map parser boundaries across the request path Identify every layer that interprets user-controlled input, including edge proxies, WAFs, frameworks, and back-end services.
- Test cache and redirect behaviour as security controls Add tests that exercise cache state, redirect chains, and cross-origin access patterns because these behaviours can leak information without touching the response body.
- Review template rendering and error handling together Treat template injection, verbose error output, and unsafe rendering as one control problem rather than separate bugs.
What's in the full article
PortSwigger's full article covers the technical detail this post intentionally leaves for the source:
- The original writeups and research names behind each of the top ten entries, including the methods and proofs of concept.
- The broader nomination list and shortlist context that shows how the community selected the final ranking.
- The expert panel’s ordering decisions and the rationale behind which techniques were prioritised.
- Further references for researchers who want to explore desync, XS-leaks, normalization, and template injection in more depth.
👉 Read PortSwigger's top 10 web hacking techniques of 2025 →
Web exploitation in 2025: are parsing gaps and side channels your blind spot?
Explore further
01/08/2026 10:54 pm
Interpretation drift is now a first-class web security risk. The strongest theme in this ranking is not one vulnerability family but the repeated failure of components to agree on what input means. That matters for identity-bearing flows because authentication, tokens, redirects, and authorization decisions all depend on consistent parsing. Practical conclusion: security teams should treat parsing consistency as part of their control model, not just a developer concern.
A question worth separating out:
Q: How can organisations reduce risk from chained web exploitation techniques?
A: Focus on the control surfaces that make chaining possible: parser consistency, safe templating, precise error handling, and cache behaviour. Then validate those controls under real traffic patterns and across all intermediaries. Chained attacks usually succeed because one weak signal is enough to open a second path, not because a single bug is catastrophic on its own.
👉 Read our full editorial: Web exploitation in 2025 shifted toward side channels and parsing gaps
