• Published: 05 January 2022 at 14:35 UTC

• Updated: 05 January 2022 at 14:42 UTC

Nominations are now open for the top 10 new web hacking techniques of 2021!

Every year security researchers share their discoveries via blog posts, presentations, and whitepapers. Every write-up is valuable, but some contain something special - innovative ideas and techniques that can be re-applied elsewhere. Since 2006, the security community has annually joined forces to sift through the year's findings and uncover the top ten pieces of research, selected for their innovation and lasting impact. At PortSwigger Research we're proud to be hosting this once again.

If this is your first time encountering this project, you can find the full origin, history and purpose of this project on our dedicated top 10 page, along with an archive of past winners and explanation of how it differs from related projects like the OWASP Top Ten.

Timeline

Today: Start collecting community nominations for the top research from 2021.
Jan 17: Launch community vote to build a shortlist of the top 15.
Jan 24: Launch panel vote on shortlist to select and order the 10 finalists.
Feb 08: Publish top 10 of 2021!.

What should I nominate?

The aim is to highlight research containing novel, practical techniques that can be re-applied to different systems. Individual vulnerabilities like log4shell are valuable at the time but typically age poorly, whereas underlying techniques such as JNDI Injection can be reapplied to great effect. Nominations can also be refinements to already-known attack classes, such as Exploiting XXE with Local DTD Files. For further examples, you might find it useful to check out previous year's top 10s.

Making a nomination

To submit, simply provide a URL to the research, and an optional brief comment explaining what's novel about the work. Feel free to make as many nominations as you like, and nominate your own research if you think it's worthy! I'll filter out weaker nominations and merge overlapping ones to keep the total number manageable.

Click here to make a nomination

We don't collect email addresses - to get notified when the voting stage starts, follow @PortSwiggerRes on Twitter.

Nominations so far

I've made some nominations myself to get things started:

• JSON Interoperability Vulnerabilities
• Dependency Confusion
• Universal Deserialisation Gadget for Ruby 2.x-3.x
• The Secret Parameter, LFR, and Potential RCE in NodeJS Apps
• Misconfigurations in Java XML Parsers
• Hidden OAuth attack vectors
• Breaking GitHub Private Pages for $35k
• Forgot password? Taking over user accounts Kaminsky style
• HTTP/2: The Sequel is Always Worse
• HTTP Smuggling via Higher HTTP Versions
• Integer overflow vulnerability in HAProxy
• Prototype Pollution
• Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond
• T-Reqs: HTTP Request Smuggling with Differential Fuzzing
• uBlock, I exfiltrate: exploiting ad blockers with CSS
• Empirical Study of HTTP Request Smuggling in Open-Source Servers and Proxies
• Weird proxies/2 and a bit of magic
• Response Smuggling- Pwning HTTP-1.1 Connections
• Remote code execution in Homebrew by compromising the official Cask repository
• Bypassing 2FA using OpenID Misconfiguration
• Pop-Ups in a good-world
• XSS to RCE in the Opera Browser
• Attacking the DevTools
• AppCache's forgotten tales

Back to all articles