Top 10 web hacking techniques of 2019
Summary: PortSwigger Research named its Top 10 new web hacking techniques of 2019 after 51 nominations were narrowed to 15 finalists by community vote and judged by a panel of Nicolas Grégoire, Soroush Dalili, Filedescriptor and James Kettle. The list includes Sam Curry's heartbleed-style memory-safety exploit, Abdulrhman Alqabandi's Edge exploit chain that earned $40,000 in bounties, Orange Tsai and Meh Chang's unauthenticated RCE in SSL VPNs, and a Web Cache Deception study of the Alexa Top 5000 that took first place.
Key Takeaway: Kettle's own HTTP Desync Attacks research, excluded from the official list, earned over $90k in bug bounties and compromised PayPal's login page twice - a reminder that the techniques catalogued here translate directly into payouts and breached login pages.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026