Web Hack List

Top 10 Web Hacking Techniques

2018

The 2018 Top 10 Web Hacking Techniques: 10 Top 10 selections, 44 other nominations and 69 later archive additions, each with its researcher, summary and…

123 records · 10 in the top ten · 44 other nominations · 69 later additions · open this year in the interactive archive

The top ten

  1. #1 Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out Orange Tsai

    Servers, frameworks and reverse proxies normalise URL paths differently, so a segment such as /..;/ or an encoded traversal is read one way by the front proxy and another by the Java backend. The mismatch bypasses proxy…

  2. #2 Practical Web Cache Poisoning James Kettle

    Unkeyed request inputs such as X-Forwarded-Host or X-Original-URL change a response that a cache then stores under an ordinary key, so every later visitor is served the attacker's version. The work chains this into…

  3. #3 Beyond XSS: Edge Side Include Injection Louis Dion-Marcil

    ESI Injection: getting Edge Side Include tags reflected into an HTTP response makes the caching surrogate in front of the application evaluate them, since it cannot tell attacker tags from upstream ones. That yields…

  4. #4 GitHub - HoLyVieR/prototype-pollution-nsec18: Content released at NorthSec 2018 for my talk on prototype pollution HoLyVieR

    Release material for the NorthSec 2018 talk that turned prototype pollution from a bad practice into an attack: APIs that recursively merge, clone or assign attacker-controlled key paths can write onto the base object…

  5. #5 Attacking "Modern" Web Technologies Frans Rosén

    Three attack families against widely deployed web features: AppCache manifests abused by cookie bombing so a forced 500 makes the FALLBACK page serve a whole directory or origin, weak cloud upload policies that let…

  6. #6 It's A PHP Unserialization Vulnerability Jim But Not As We Know It Sam Thomas

    Any PHP file operation on an attacker-controlled path beginning phar:// unserializes the archive's metadata, so file-existence checks, XXE and SSRF bugs become object injection. A Phar can be disguised as a valid JPEG…

  7. #7 Exploiting XXE with local DTD files Arseniy Sharoglazov and @_mohemiv

    Blind XXE usually needs an attacker-hosted DTD because the internal subset forbids a parameter entity inside markup. Loading a DTD file that already exists on the target host and redefining one of its parameter entities…

  8. #8 Prepare(): Introducing Novel Exploitation Techniques in WordPress Robin Peraglie

    WordPress before 4.8.3 allowed SQL injection when prepare() was applied twice to input containing placeholders. Its fix introduced secret percent-sign tokens: when a WP_Query containing those tokens is serialized for…

  9. #9 Data Exfiltration via Formula Injection #Part1 Ajay and Balaji

    Spreadsheet formulas planted in imported CSV data run when the sheet is opened, and built-in functions that fetch remote resources carry data out of band. In Google Sheets IMPORTXML and friends exfiltrate other users'…

  10. #10 XS-Searching Google's bug tracker to find out vulnerable source code Luan Herrera and @lbherrera_

    Monorail's CSV export lacked CSRF protection and allowed a column to be repeated, so a search that matched a bug returned a hugely inflated file. Timing how long that response takes to enter the Cache API answers…

Other nominations

Added after the original list