In-app reader
Login
_ _
_ _ _ _ _
Products
Solutions
Research Academy
Support
Company
Customers About Blog Careers Legal Contact Resellers
My account Customers About Blog Careers Legal Contact Resellers
Burp AT Agentic AI that extends human-led pentesting.
Burp Suite DAST The enterprise-enabled dynamic web vulnerability scanner.
Burp Suite Professional The world's #1 web penetration testing toolkit.
Burp Suite Community Edition The best manual tools to start web security testing.
View all product editions
Burp Scanner
Burp Suite's web vulnerability scanner
Attack surface visibility Improve security posture, prioritize manual testing, free up time. CI-driven scanning More proactive security - find and fix vulnerabilities earlier. Application security testing See how our software enables the world to secure the web. DevSecOps Catch critical bugs; ship more secure software, more quickly.
Penetration testing Accelerate penetration testing - find more bugs, more quickly. Automated scanning Scale dynamic scanning. Reduce risk. Save time/money.
Bug bounty hunting Level up your hacking and earn more bug bounties. Compliance Enhance security monitoring to comply with confidence.
View all solutions
Product comparison
What's the difference between Pro and DAST?
Support Center Get help and advice from our experts on all things Burp. Documentation Tutorials and guides for Burp Suite. Get Started - Professional Get started with Burp Suite Professional. Get Started - DAST Get started with Burp Suite DAST. Downloads Download the latest version of Burp Suite.
Visit the Support Center
Downloads
Download the latest version of Burp Suite.
_
Articles
Overview
_
Core Topics
Black Hat XSS Request Smuggling Template Injection Top 10 Hacking Techniques
Articles
_
Meet the Researchers
James Kettle Gareth Heyes Zakhar Fedotkin Tom Stacey
Talks
RSS
_
_
Director of Research
**Published: **Tuesday, 6 January 2026 at 15:31 UTC
**Updated: **Friday, 16 January 2026 at 14:11 UTC
Update: nominations are now closed, and voting is live! Cast your vote here
Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentations, and whitepapers. This is great, but it also means genuinely reusable techniques can get buried, and even flashy findings eventually get eclipsed as everyone chases the next shiny logo.
Since 2006, the community has come together each year to turn that firehose into two useful resources:
A lightly curated list of notable web security research from the last year
A focused top ten of the most valuable, must-read work
If you want to dig through past nominees and winners or learn more about the project history, check out the full project archive. Otherwise, read on to find out how to make your nominations for 2025.
This year, we'll target the following timeline:
Jan 6-13: Collect community nominations for the top research from 2025
Jan 14-21: Community votes on nominations to build a shortlist of the top 15
Jan 22: Launch panel vote on shortlist to select and order the 10 finalists
Feb 03: Publish top 10 web hacking techniques of 2025!
The aim is to highlight research containing novel, practical techniques that can be re-applied to different systems. Individual vulnerabilities like log4shell are valuable at the time but typically age poorly, whereas underlying techniques such as JNDI Injection can be reapplied to great effect. Nominations can also be refinements to already-known attack classes, such as Exploiting XXE with Local DTD Files. For further examples, you might find it useful to check out previous year's top 10s.
To submit, simply provide a URL to the research, and an optional brief comment explaining what's novel about the work. Feel free to make as many nominations as you like, and nominate your own work if you think it's worthy!
Click here to submit a nomination
Please note that I'll filter out nominations that are non-web focused, just tools, or not clearly innovative to keep the number of options in the community vote manageable. We don't collect email addresses - to get notified when the voting stage starts, follow @PortSwiggerRes on X, LinkedIn, or BlueSky.
We'd love to hear from you! If you have any questions or you'd like to discuss this year's batch of research, join us in the #research channel on the PortSwigger Discord.
I've made a few nominations myself to get things started, and I'll update this list with fresh community nominations every few days. I've included AI-assisted summaries of each entry.
Eclipse on Next.js: Conditioned exploitation of an intended race-condition Racing Next.js’s response-cache batcher by forcing disparate failing requests to collide on a shared error cache-key, leaking a transient pageProps HTML variant that can then be externally cached for poisoning-to-SXSS despite prior fixes.
Next.js, cache, and chains: the stale elixir Chaining a spoofable framework-internal header with Next.js data-request mechanisms to force-cache SSR JSON as HTML, enabling cache-poisoning DoS and stored XSS via stale-while-revalidate.
Unexpected security footguns in Go's parsers Chaining Go’s case-insensitive JSON key matching, last-wins duplicate keys, and XML’s tolerance for leading/trailing garbage to craft cross-format polyglot inputs that different services/parsers interpret differently, enabling authz/authn bypasses.
HTTP/1.1 must die: the desync endgame Leveraging Expect handling quirks and early-response gadgets to turn 0.CL deadlocks into reliable double-desync request smuggling that enables response queue poisoning and cross-tenant cache/content hijacking.
Under the Beamer Chaining Chromium HTMLCollection DOM clobbering with a library-driven node-removal gadget to null out an escaping function at runtime, then pivoting into an innerHTML iframe-attribute injection sink to bypass DOMPurify and get XSS.
Opossum Attack Cross-protocol application-layer desynchronization by MITM-switching a victim’s implicit TLS connection onto an opportunistic TLS upgrade endpoint to inject pre-handshake messages and permanently misalign request/response streams.
The Fragile Lock: Novel Bypasses For SAML Authentication Void Canonicalization: forcing canonicalization to error so signature-digest code treats the signed data as empty, combined with parser namespace/attribute inconsistencies to make signature verification and assertion processing diverge for full SAML auth bypass.
Funky chunks: abusing ambiguous chunk line terminators for request smuggling Abusing chunked-body line-terminator ambiguity inside ignored chunk extensions and oversized-chunk spill to create new request-smuggling differentials (including the newly identified EXT.TERM and spill-based variants) without relying on Content-Length vs Transfer-Encoding confusion.
Funky chunks – addendum: a few more dirty tricks New HTTP request smuggling primitives exploiting chunked parsing discrepancies via two-byte chunk-body terminator overreads and ambiguous trailer-section newline handling (including request merging enabled by early-response gadgets).
Cross-Site WebSocket Hijacking Exploitation in 2025 Leveraging CSWSH via WebSocket-accessible GraphQL to bypass preflight-gated CSRF protections, plus showing that Private Network Access doesn’t apply to WebSockets so cross-origin WebSockets can still reach private-IP services.
SVG Filters - Clickjacking 2.0 Abusing SVG filter pipelines on cross-origin iframes to read selected pixels and implement logic-gated, multi-step interactive clickjacking with exfiltration via user-scanned QR codes generated entirely inside the filter.
Nonce CSP bypass using Disk Cache Forcing bfcache to fall back to disk cache to reuse a leaked CSP nonce (via CSS exfiltration) while recaching only the injectable fetched content through cache-key manipulation, enabling nonce-based CSP bypass.
Novel SSRF Technique Involving HTTP Redirect Loops Exploiting redirect-loop status-code variation (cycling uncommon 3xx responses) to trigger an application error state that leaks the full SSRF redirect chain and final 200 response.
Lost in Translation: Exploiting Unicode Normalization Weaponizing Unicode normalization mismatches (virtual confusables/best-fit mappings and truncation/overflow edge cases) to bypass validation and turn benign input into malicious behavior.
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL Abusing .NET SOAP proxy generation from attacker-supplied WSDL to set a non-HTTP scheme that turns SOAP invocations into arbitrary file writes (and NTLM relay) culminating in webshell/script drop RCE.
Forcing Quirks Mode with PHP Warnings + CSS Exfiltration without Network Requests Triggering quirks mode via early PHP warnings to relax same-origin stylesheet MIME checks, then using 404-reflected text as a CSS sink plus :valid-based regex matching and frame-counting as a no-request oracle to exfiltrate secrets under CSP.
ORM Leaking More Than You Joined For Abusing Beego’s filter-expression segment-overwrite quirk to smuggle disallowed fields past partial validation, plus Prisma auth bypass via type confusion that coerces user input into operator objects through common request parsers.
Parser Differentials: When Interpretation Becomes a Vulnerability Exploiting parser differentials—mismatches between how components interpret the same input—to turn benign-looking data into security bypasses.
DOM-based Extension Clickjacking: Your Password Manager Data at Risk DOM-based extension clickjacking that hides and repositions password-manager autofill UI injected into the page DOM so a single coerced click triggers secret autofill into attacker-controlled fields for exfiltration.
XSS-Leak: Leaking Cross-Origin Redirects Using Chromium connection-pool exhaustion plus deterministic host-sorting as a timing oracle to infer cross-origin fetch and redirect destinations (including subdomains) without injection.
Google Cloud Account Takeover via URL Parsing Confusion | by Mohamed Benchikh
Exploiting an IPv6-specific multi-@ userinfo parsing discrepancy between an OAuth redirect validator and the browser to bypass loopback-only allowlists and exfiltrate authorization codes for account takeover.
How I Accessed 1,800 Company Livestreams and Uncovered a New Web Exploit Class: RRE | by Farzan Karimi Chaining unauthenticated upstream metadata APIs to recursively reconstruct an entitlement workflow and reach protected media streams, guided by entropy-based discovery of the first sensitive reference (RRE).
Exploiting The Not So Misuse-Resistant Authenticated Encryption API of OpenSSL Abusing AEAD tag-length truncation in OpenSSL bindings to brute-force short tags, then leveraging the resulting nonce-reuse condition to recover the GHASH/Poly1305 subkey and forge/decrypt arbitrary ciphertexts via a format-validity oracle.
Permission Hijacking at Scale Compromising widely embedded support widgets to inherit and weaponize delegated browser permissions at scale via account-takeover-to-widget-code-injection chains (XSS/HTML injection plus CSP bypasses).
Playing with HTTP/2 CONNECT Leveraging HTTP/2 CONNECT stream multiplexing to turn misconfigured forward proxies into a high-throughput internal port scanner over a single connection, potentially evading monitoring that can’t inspect per-stream tunnels.
Stopping Redirects Abusing browser navigation-blocking quirks (URL/protocol restrictions, induced error pages plus Navigation API history leakage, redirect-throttling via rapid same-site navigations, and sandboxing without allow-forms to suppress auto-submitted form redirects) to keep OAuth callback codes readable before they’re consumed.
ASP.NET MVC View Engine Search Patterns Chaining arbitrary file-write via path traversal with ASP.NET MVC view resolution to get Razor execution by invoking a routed action (no extension) so the view engine loads and compiles a planted view file despite IIS extension whitelisting.
Bypassing CSP with New Relic Custom Events Abusing a strict connect-src allowlist by redirecting an auth-token POST to New Relic and then exfiltrating the JSON body via NRQL error-log sampling, enabled by a URL-parsing/authentication discrepancy that treats path-embedded key material as valid.
CRLF Injection Nested Response Splitting CSP Gadget Chaining CRLF response splitting into a same-origin script load that itself performs a second response split to emit truncated JavaScript, bypassing strict CSP via Content-Length/Transfer-Encoding manipulation (“nested response splitting”).
CVE-2025-1974: The IngressNightmare in Kubernetes Chaining unauthenticated admission-webhook NGINX config injection with abusing client-body buffering plus ProcFS file-descriptor reuse to load a transient in-container shared library via an obscure directive during config testing for RCE.
ReDisclosure: New technique for exploiting Full-Text Search in MySQL (myBB case study) Bypassing search-term sanitization by abusing MySQL full-text boolean operator parsing and early-exit length checks to turn result-vs-error redirects into a blind oracle for enumerating otherwise-hidden thread titles.
Python Dirty Arbitrary File Write to RCE via Writing Shared Object Files Or Overwriting Bytecode Files
Achieving Python RCE from dirty arbitrary file write by overwriting valid .pyc headers to load injected bytecode without restart, or more powerfully by dropping a compiled extension module that import resolution prefers over .py/.pyc, optionally forcing a re-import via process reload triggers.
SharePoint ToolShell – One Request PreAuth RCE chain CVE-2025-53770 Chaining a referrer-based auth bypass with an init-phase ToolPane invocation and a generic-wrapper type-confusion to defeat DataSetSurrogateSelector’s allowlist, then reaching TemplateParser via a templated safe control to trigger a deserializing gadget for one-request pre-auth RCE.
Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks Prompt-injecting untrusted issue/PR/commit text into AI-agent prompts in CI/CD to coerce privileged tool execution, enabling secret exfiltration and repository manipulation.
Attacks via a New OAuth flow, Authorization Code Injection, and Whether HttpOnly, PKCE, and BFF Can Help Leveraging same-origin script execution to steal and replay OAuth authorization responses while “breaking” the redirect flow (e.g., via response-mode switching/window interruption) to perform authorization code injection that bypasses BFF and PKCE by harvesting server-set pre-auth cookies out-of-band.
Blind trust: what is hidden behind the process of creating your PDF file? Bypassing PDF-renderer path-traversal mitigations via URL-decoding/double-encoding quirks and exploiting PDF-generation resource loaders to trigger phar stream-wrapper deserialization and “security hook runs too late” SSRF.
Impossible XXE in PHP Chaining libxml2 parameter-entity expansion quirks with PHP stream wrappers and filter-chains to bypass nonet/double-parse/doctype checks, inline a compressed DTD via data:, and exfiltrate files over DNS.
Blind SSTI Leveraging reflected runtime errors to exfiltrate code/template-evaluation output and using conditional error triggering as a boolean-blind oracle for Code Injection and SSTI without time delays.
Disguises Zip Past Path Traversal The return of Zip Slip!
Hacking Gemini: A Multi-Layered Approach Chaining Markdown/HTML linkification and cross-product export layers to flip sanitized links into images and evade URL rewriting, enabling zero/one-click Workspace data exfiltration via indirect prompt injection.
Make XXE Attacks Brilliant Again !!! Leveraging Windows UNC paths via file/netdoc handlers to exfiltrate multi-line XXE data over SMB when JDK FTP/HTTP OOB channels are newline-sanitized.
Cross-Site ETag Length Leak Chaining cross-site ETag length variation into a 431-induced navigation failure and detecting it via Chromium history replacement to build an XS-Leak oracle.
Make Self-XSS Great Again Abusing credentialless iframes’ same-origin access plus login CSRF/clickjacking to turn stored self-XSS into stored XSS, and using fetchLater’s deferred requests to execute authenticated actions later even after the tab closes (bypassing framing limits).
Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains | Critical Thinking
Abusing implicit toString coercion to invoke a global “this.foo(this.bar)” gadget chain that pivots expression-sandbox member access into eval for DOM XSS, with a noted variant enabling argumentless function-call WAF bypass via valueOf-style coercion.
Fontleak: exfiltrating text using CSS and Ligatures Abusing CSS-only injection with a crafted ligature font and container queries to turn per-character glyph-width differences into conditional network requests, plus browser-specific import/font chaining to iterate indices and exfiltrate long text (including inline script secrets) even under common sanitizers.
The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling Combining single-packet parallelization with HTTP/2→HTTP/1 downgrade desync to reliably detect and exploit request tunnelling for frontend rule/rewriter bypasses (notably via whitespace-tolerant length-header mutations in major load balancers/CDNs).
Ruby Array Pack Bleed Triggering an integer signedness wrap in Ruby Array#pack repeat-count parsing to turn the X “back up” directive into a negative shrink that grows the string length and leaks out-of-bounds heap memory.
Racing and Fuzzing HTTP/3: Open-sourcing QuicDraw(H3) Adapting the last-byte-sync single-packet race technique to HTTP/3 by buffering near-complete requests across many QUIC streams and then releasing them simultaneously via a coordinated FIN “last-byte” burst (Quic-Fin-Sync).
How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs Abusing production-whitelisted localhost OAuth origins/redirects on mobile by running a malicious loopback webserver to silently capture tokens via auto-reauthentication, plus exploiting mixed-content CORS allowing credentialed requests from insecure subdomains via MITM with browser-specific cookie behavior.
Client Side Path Traversal (CSPT) Bug Bounty Reports and Techniques Chaining client-side path traversal in SPA/REST fetch routing (via backslash/double-encoding normalization) with open redirects or user-uploaded JSON to spoof API responses and reach DOM XSS/URL-leak-driven OAuth takeover.
PermissionJacking: How a Subtle Bug in Safari Could Lead to Camera Hijacking Clickjacking Safari’s unfocused, still-clickable TCC prompts by overlaying them with a pop-up and using rapid resize race-condition flicker or double-click window-closing to misdirect clicks into granting camera/mic/location permissions.
[The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth
…(truncated for reading performance)
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.