Web Hack List

Top 10 Web Hacking Techniques

2025

The 2025 Top 10 Web Hacking Techniques: all 10 winners and 109 nominated and collected techniques, each with its researcher, summary and preserved source.

109 records · 10 in the top ten · open this year in the interactive archive

The top ten

  1. #1 Blind SSTI Vladislav Korchagin

    Two exploitation techniques for code injection and server-side template injection: Error-Based, which triggers errors whose messages reflect the injected code's output, and Boolean Error-Based Blind, which conditionally…

  2. #2 ORM Leaking More Than You Joined For Alex Brown

    ORM Leak attacks let a user who controls a filter expression search sensitive columns such as password hashes or reset tokens character by character. This instalment bypasses Harbor's patches via an expression-parsing…

  3. #3 Novel SSRF Technique Involving HTTP Redirect Loops Shubham Shah and @searchlightsec

    A blind SSRF that discloses nothing for a successful response may return the whole response for an error status. Serving a redirect loop that increments the status code through the 3xx range drives the client into that…

  4. #4 Lost in Translation: Exploiting Unicode Normalization Ryan Barnett and Isabella Barnett

    How Unicode handling diverges between a front-end proxy or CDN and the back-end application. Decoding errors, overlong encodings, byte truncation, confusables, case mapping and combining diacritics all let input that…

  5. #5 SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL @chudyPB and Piotr Bazydlo (@chudyPB)

    A missing cast in .NET Framework's SOAP HTTP client proxies lets a file:// or UNC URL make the proxy write its SOAP request body to disk instead of sending it. Attacker-supplied WSDL sets that URL and much of the body…

  6. #6 Cross-Site ETag Length Leak arkark

    Turns the ETag header into a cross-site oracle: ETag encodes response size in hex, so crossing a hex-digit boundary changes its length by one byte, echoed back in If-None-Match, which can push a padded request past the…

  7. #7 Next.js, cache, and chains: the stale elixir zhero

    The internal x-now-route-matches header makes Next.js treat a server-side-rendered request as static and return a cacheable Cache-Control, while the __nextDataReq parameter turns the response into the pageProps JSON…

  8. #8 XSS-Leak: Leaking Cross-Origin Redirects Salvatore Abello and @salvatoreabello

    Chrome schedules equal-priority pending requests by port, then scheme, then host, so with the socket pool exhausted an attacker can race their own request against a victim page's cross-origin request and learn whether…

  9. #9 Playing with HTTP/2 CONNECT blog.flomb.net

    In HTTP/2 the CONNECT method tunnels over a single stream instead of hijacking the whole TCP connection, so many tunnels can be multiplexed on one connection. The author builds a Go tool that abuses this against…

  10. #10 Parser Differentials: When Interpretation Becomes a Vulnerability Joern Schneeweisz

    Two parsers read the same document differently: duplicate JSON keys, and YAML local versus global binary tags, make a validator and the consumer disagree. One crafted file looks benign to a scanner, ingress or auth…

Also collected