Topic starter
01/08/2026 10:45 pm
TL;DR: Parser differentials, cache poisoning, Unicode normalization, SSRF visibility, ORM leakage and error-based code injection dominate PortSwigger’s 2025 top ten because researchers are finding more ways to exploit edge-case behaviour. Web defenses need tighter normalisation and better telemetry to close blind paths attackers can use.
Editorial analysis by NHI Mgmt Group, based on content published by PortSwigger: “Top 10 web hacking techniques of 2025”.
By the numbers:
- The 2025 edition drew 63 nominations as contenders before community voting and expert review narrowed the field.
Key questions
Q: Why do side channels matter when direct data leakage is blocked?
A: Because attackers rarely need the response body if they can measure timing, redirect behaviour, cache state, or response size.
Q: Where do cache poisoning and ORM leakage fail in practice?
A: They fail when teams assume shared caches and data access layers are isolated and deterministic.
Q: What breaks when an application parses the same input differently at each layer?
A: Security decisions break when validation, routing and browser interpretation are applied to different normalised values.
Practitioner guidance
- Harden parsing and normalisation boundaries Test every place where proxies, frameworks, WAFs, and application code may interpret the same input differently, and block ambiguous request forms before they reach business logic.
- Instrument behavioural leakage signals Add detection for redirect chains, response-size variance, cache-state changes, and unusual timing patterns that can reveal hidden resources or control flow.
- Audit shared caches and framework state reuse Review internal cache keys, response variation rules, and ORM query paths to ensure one request cannot poison or disclose state for another user.
Bottom line: The central risk in 2025 web exploitation is not only injection, but attackers using parser gaps and side channels to turn ordinary application behaviour into a control bypass.
Glossary terms: Parser Differential, Side Channel, Queue Poisoning, Unicode Normalization
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
01/08/2026 10:54 pm
Parsing ambiguity is now a governance problem, not just a code defect. The article shows that attackers keep finding value in differences between how layers interpret the same request. That means application security reviews need to account for trust boundaries between parsers, proxies, browsers, and frameworks, not just the application code itself. Practitioners should treat canonicalisation consistency as part of control design.
A question worth separating out:
Q: How should security teams test for blind web exploitation paths?
A: They should include attacks that are visible only through secondary signals, such as redirects, timing, cache variation, unicode normalisation, and error-based behaviour. Those tests should sit alongside classic injection checks, because modern exploitation often depends on discovering what the application leaks indirectly rather than what it prints outright.
👉 Read our full editorial: Web exploitation in 2025 shifted toward side channels and parsing gaps