Web App Hacker's Handbook 2nd Edition - Preview
Summary: PortSwigger's Dafydd Stuttard reports that the first draft of the second edition of The Web Application Hacker's Handbook is complete, with publication set for October and roughly 30% of the content new or extensively revised. The edition adds several hundred interactive online labs tied to 'Try it!' links, new chapters splitting cross-site scripting from other user-targeted attacks, and new material on cloud architecture flaws, NoSQL and LDAP injection, and circumventing web application firewalls.
Key Takeaway: The book's own accounting is that 70% of the first edition still holds, which tells a security leader that most of the attack techniques their applications face are old, well-documented, and still worth testing for - and that the several hundred labs give defenders a concrete way to check whether their own teams can find them.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026