Top 10 Web Hacking Techniques of 2017
Summary: PortSwigger Research published its Top 10 Web Hacking Techniques of 2017, drawn from 37 nominations narrowed to a 15-item shortlist by community vote and judged by a panel of James Kettle, Gareth Heyes, Nicolas Grégoire, Frans Rosén and Soroush Dalili. The top three were Orange Tsai's 'A New Era of SSRF', Omer Gil's Web Cache Deception demonstrated on PayPal, and Inti De Ceukelaire's Ticket Trick, which abuses issue trackers and support centers that trust email addresses ending in a given domain.
Bottom line: Web Cache Deception still works on multiple major caches, and Ticket Trick exploits systems that implicitly trust every address on a domain - two techniques that turn ordinary trust assumptions into data exposure and account takeover.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026