Top 10 web hacking techniques of 2023
Summary: PortSwigger Research published its 17th annual Top 10 Web Hacking Techniques list for 2023, drawing a record 68 community nominations that were narrowed to 15 finalists and then voted on by an expert panel of Nicolas Grégoire, Soroush Dalili, Filedescriptor, and James Kettle. The top entries included SMTP Smuggling by Timo Longin in third place, Exploiting Hardened .NET Deserialization by Piotr Bazydło, and Kettle's own Smashing the state machine in first, which he disclosed as self-published research.
What's compelling: The list's recurring theme is parser discrepancy attacks - HTTP request splitting still live in nginx, SMTP smuggling spoofing email worldwide, and parser inconsistencies yielding ACL bypasses and WAF bypasses - meaning the parsing layer your defenses assume is consistent is where 2023's most durable techniques landed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026