Web hacking techniques of 2021 (portswigger.net)

Article summary

The article presents the top 10 web hacking techniques of 2021, as determined by a community-powered effort. The techniques include HTTP Request Smuggling, JSON Interoperability Vulnerabilities, and Dependency Confusion, among others. The article highlights the significance of these techniques and their potential impact on web security. The research quality in 2021 was exceptional, leading to fierce competition for the top 10 list.

Main themes

• web hacking techniques
• HTTP Request Smuggling
• langsec and formal methods
• client-side rendering vs server-side rendering
• input validation and parsing
• complexity of languages and protocols
• real-world relevance of security research
• bug bounties and testing environments

What commenters say

• Some commenters appreciate the simplicity and elegance of certain techniques, such as Dependency Confusion.
• Others question the practical relevance of these techniques in real-world scenarios and whether they are actually used by threat actors.
• There is a discussion about the safety of client-side rendering versus server-side rendering, with some arguing that client-side rendering is not inherently safer.
• The use of complex languages and protocols is seen as a contributing factor to the difficulty of fixing certain vulnerabilities.
• Some commenters express interest in learning more about langsec and formal methods, but find the current resources to be inaccessible or poorly introduced.
• Others share their experiences with bug bounties and the challenges of setting up realistic test environments to find profound security research results.
• There is a concern that the repetition of certain techniques, such as request smuggling, on the list may be unnecessary.
• The importance of proper input validation and parsing is emphasized as a key take-away from the discussion.