The complete archive of the Top 10 Web Hacking Techniques — every nominated technique (not just the winners) for every year since 2006, plus PDF snapshots of the original announcement posts so the record survives its hosts.
🌐 Read it online at webhacklist.com
Search every technique, filter by year, and open any preserved document without leaving the browser.
Browse by year · Where things are · File layout · The three eras · The PDF archive · Face the Judge · Support · Contributing
Every year since 2006, the web security community has nominated the most innovative web hacking research, voted, and crowned a Top 10. The list was started by Jeremiah Grossman and is continued today by James Kettle at PortSwigger.
The annual announcement posts, however, have a habit of disappearing — WhiteHat Security's blog (home of the 2011–2015 lists) is already gone. This repository keeps the whole thing in one durable, greppable place:
- One Markdown file per year with every nominated technique — all 1,136 of them, plus 351 later audit finds the nomination rounds missed, for 1,487 techniques spanning two decades of web security research.
- PDF snapshots of the original nominee and winner announcement pages, captured with reproducible tooling and recorded provenance.
Important
The year lists are complete: everything that was officially nominated is in.
That said, the nomination rounds occasionally missed notable research. If you know
of work that should have been on a year's list, open an issue or PR — anything that
qualifies as a web hacking technique nominee for that year will be reviewed and,
if it fits, added to its relevant year. Later audit additions are visibly separated
from the original nominations, require a score of 60 or above plus a verified
non-duplicate verdict, and retain both accepted and rejected evidence under
ai-evaluation/.
Tip
Many of the older links have died. Paste any dead URL into the Wayback Machine — most are preserved there, and the PDF archive preserves the announcement pages themselves.
webhacklist/
├── 2006.md … 2025.md ← the lists — every nominated technique, one file per year
├── <year>-ai.md ← AI-collected candidates for a year with no vote yet — machine-assembled, unreviewed, kept deliberately separate from the curated lists above
├── ai-evaluation/<year>/ ← all AI-reviewed leads, readable scorecards, and append-only judgement history
├── original-listings/ ← PDF snapshots of the original announcement posts
│ ├── <year>-nominees.pdf ← the full nominee list for that year
│ ├── <year>-top10.pdf ← the post naming the winning ten
│ └── README.md ← per-year index, notes, and archive rationale
├── website/ ← production progressive archive website
│ ├── archive-years.json ← publishing registry
│ └── data/ ← generated small catalogue + one JSON shard per collection
├── tools/ ← the capture pipeline that builds the PDF archive
│ ├── capture_pdf.py ← headless-Chrome capture driver + verifier
│ ├── sources.json ← manifest: what to capture, from where, with assertions
│ └── capture-report.json ← provenance log of the last run
└── assets/ ← logo and artwork
Every <year>.md opens with a ## Top 10 section holding the ten techniques that
actually won that year's vote, in finishing order, each tagged with its rank:
## Top 10
- [Blind SSTI](https://github.com/vladko312/Research_Successful_Errors) **#1**
- [ORM Leaking More Than You Joined For](https://www.elttam.com/blog/leaking-more-than-you-joined-for/) **#2**Every year file uses that one layout: one - bullet per technique, no trailing
backslashes and no blank lines inside the lists.
Everything else nominated that year follows under ## Other nominations, unranked
and in its original order. So you can read the ten that stood out without losing the
long tail — which is often where the genuinely novel work hides.
Note
Ranks come from the announcement posts, but the entry text stays as the nominee list had it. A winner's title in the results post is sometimes shorter or worded differently from its nomination, so the two don't always read identically.
In four years the organisers kept some research out of the competition to avoid a
conflict of interest. Rather than let it vanish, those entries sit at the top of
## Other nominations, each tagged with the stage it was held out of — the stages
differed, so the wording does too — under a note explaining what happened:
| Year | Held out | Why |
|---|---|---|
| 2016/17 | Cracking the Lens; XSS without HTML | PortSwigger research was excluded up front; by the time a recusal system replaced that rule it was too late to reintroduce it, so it never even reached the nominee list |
| 2019 | HTTP Desync Attacks | Won the community vote outright, but James Kettle declined to rank his own research first |
| 2024 | Gotta cache 'em all; Splitting the email atom; Listen to the whispers | All three reached the final fifteen and were then held out of the panel vote |
| 2025 | HTTP/1.1 must die | Reached the final fifteen, held out of the panel's top ten |
Every other year the organisers state that their own research competed normally — in 2020 PortSwigger's Portable Data exFiltration placed 2nd, and in 2021 HTTP/2: The Sequel is Always Worse placed 2nd — so nothing is missing from those.
Each year links to its curated list. Nominated counts the techniques that went into
that year's official round — the community nominated far more than ten per year.
Audit counts the research that round missed, recovered later and kept visibly
separate under ## Missed from the original list.
| Year | Nominated | Audit | Total | 🏆 #1 technique | Archived PDFs | Original post |
|---|---|---|---|---|---|---|
| 2025 | 67 | 13 | 80 | Successful Errors | nominees · top 10 | PortSwigger |
| 2024 | 119 | 21 | 140 | Confusion Attacks | nominees · top 10 | PortSwigger |
| 2023 | 68 | 16 | 84 | Smashing the State Machine | nominees · top 10 | PortSwigger |
| 2022 | 46 | 23 | 69 | Dirty Dancing in Sign-in OAuth Flows | nominees · top 10 | PortSwigger |
| 2021 | 40 | 13 | 53 | Dependency Confusion | nominees · top 10 | PortSwigger |
| 2020 | 54 | 12 | 66 | H2C Smuggling | nominees · top 10 | PortSwigger |
| 2019 | 50 | 16 | 66 | Cached and Confused | nominees · top 10 | PortSwigger |
| 2018 | 54 | 22 | 76 | Breaking Parser Logic | nominees · top 10 | PortSwigger |
| 2016/17 | 39 | 56 | 95 | A New Era of SSRF | nominees · top 10 | PortSwigger |
| 2015 | 39 | 29 | 68 | FREAK | combined | Wayback † |
| 2014 | 46 | 20 | 66 | Heartbleed | combined | Wayback † |
| 2013 | 32 | 19 | 51 | Mutation XSS | combined | Wayback † |
| 2012 | 56 | 20 | 76 | CRIME | combined | Wayback † |
| 2011 | 51 | 16 | 67 | BEAST | nominees · top 10 | Wayback † |
| 2010 | 69 | 19 | 88 | 'Padding Oracle' Crypto Attack | nominees · top 10 | Jeremiah's blog |
| 2009 | 83 | 11 | 94 | Creating a Rogue CA Certificate | nominees · top 10 | Jeremiah's blog |
| 2008 | 70 | 10 | 80 | GIFAR | nominees · top 10 | Jeremiah's blog |
| 2007 | 83 | 9 | 92 | XSS in Common Shockwave Flash Files | nominees · top 10 | Jeremiah's blog |
| 2006 | 70 | 6 | 76 | Web Browser Intranet Hacking / Port Scanning | combined | Jeremiah's blog |
| Total | 1,136 | 351 | 1,487 |
A further 47 AI-collected leads for 2026 sit in 2026-ai.md, unranked,
incomplete and not community-vetted, deliberately kept apart from the curated lists above.
† The WhiteHat Security blog is offline; these links go to the Wayback Machine — which is exactly why the PDF archive exists.
timeline
title The Top 10 Web Hacking Techniques through the years
section Jeremiah Grossman era
2006 : First "Top 10 Web Hacks" published on Jeremiah's blog
2007–2010 : The list grows to 80+ candidates a year
section WhiteHat Security era
2011–2015 : Published on the WhiteHat Security blog
: Blog now offline — rescued here as PDFs
section PortSwigger era
2016/17 : James Kettle takes over on portswigger.net/research
2018–2025 : Community nominations + expert panel, still running every year
| Years | Curator | Original host | Status |
|---|---|---|---|
| 2006–2010 | Jeremiah Grossman | jeremiahgrossman.blogspot.com |
✅ Live, now at blog.jeremiahgrossman.com |
| 2011–2015 | Jeremiah Grossman / Johnathan Kuskos | whitehatsec.com/blog |
☠️ Dead — captured from the Wayback Machine |
| 2016/17–2025 | James Kettle | portswigger.net/research |
✅ Live |
original-listings/ holds PDF snapshots of every original announcement page — for each year, both the full nominee list and the post naming the selected top ten. They are generated by tools/capture_pdf.py (headless Chrome over CDP, stdlib-only), driven by a manifest with content assertions, and every file's provenance — source URL, HTTP status, page count — is logged in tools/capture-report.json.
python tools/capture_pdf.py list # show the manifest
python tools/capture_pdf.py run # capture anything not already present
python tools/capture_pdf.py verify # re-check every PDF against its assertionsSee tools/README.md for the full usage and design notes, and original-listings/README.md for the per-year index.
Note
The articles themselves are preserved too. The announcement pages are only half the
story, so each cited research article is kept as its own Markdown + PDF copy under
archived-references/ — 1,531 of the 1,534 cited sources
today. 419 of them had to be recovered from the Wayback Machine because the original
page no longer answers, and 25 non-English sources are kept in the original with an
English translation beside them.
The year Markdown, archive manifest, and year registry remain the sources of truth; the web-app JSON is derived and should never be edited by hand. After archive data changes, run:
python .claude/skills/webseclist-refresh-web-apps/scripts/refresh_web_apps.pyThis refreshes the production website and validates its totals. The app first downloads
a roughly 8 KB catalogue and the requested collection (currently no shard is over 200 KB
raw), then warms the remaining versioned collection shards during idle time. Save-Data
and 2G clients stay strictly on-demand. When deploying, publish the shards before the
catalogue and revalidate the catalogue frequently; versioned shard URLs can use a long
cache lifetime. website/build-site.mjs stages only the archive documents referenced by
those shards, so adding a year or preserved reference automatically grows the deployed
site without maintaining a second hand-written index.
webhacklist.com runs on Cloudflare Pages, built with
node website/build-data.mjs && node website/build-site.mjs --target cloudflare and
dist as the output directory. A push to master is the only deploy step. The GitHub
Pages workflow is not a second copy of the app: it is a small file origin publishing
only the preserved PDFs that exceed Cloudflare Pages' 25 MiB per-file asset limit —
two of them today. Their exact URLs are declared in website/hosting.json, and the app
falls back to them transparently when a document is too large to serve from the primary
host. See website/README.md for DNS, cache, full-screen and mobile
deployment details.
So you think your research is Top 10 material? Prove it.
Twenty years of this list have made one thing clear: the work that lasts is rarely the
work with the scariest headline. So this repo ships a research evaluator — a Claude
Code skill, webseclist-judge-reference,
that reads a writeup, hunts for prior art across both the 1,500+ references archived
here and the wider web, and hands down a verdict: original technique, meaningful
extension, clever combination, nice case study … or the dreaded "already known."
It is a fair judge, and a merciless one. It does not care about your CVE number, your bounty, your severity rating, your employer, or your follower count — none of those measure whether you actually taught the field something new. A find that hands you domain-admin on a bank can score low if the trick is textbook; an obscure parser quirk that births a whole new primitive can score high. Impact ≠ novelty. That's the entire point.
Every candidate is scored 0–100 across six weighted axes:
| Axis | Weight | It's really asking… |
|---|---|---|
| 🧠 Original contribution | 25% | Did this teach the field something genuinely new? |
| 🌍 Transferability | 20% | Does the idea travel beyond the one target you hit? |
| ⏳ Lasting value | 20% | Will people still build on this in a few years? |
| 🔬 Technical soundness | 15% | Does the evidence actually back the claims? |
| 🛠️ Practical usability | 10% | Can others pick it up and use it? |
| 📆 Clarity & reproducibility | 10% | Is there enough here to follow and verify? |
Bands run 0–19 barely-there · 20–39 limited · 40–59 moderate · 60–79 strong · 80–100 exceptional — and 50 is an honest middle, not a fail. The weighted total then maps to a verdict: ≥ 70 with a novelty verdict is core-technique material, ≥ 50 earns keep it as a supporting reference, and below that it's already covered.
Tip
Brave enough? In Claude Code, point it at your latest post:
/webseclist-judge-reference https://your-blog.example/your-shiny-new-technique
No Claude Code? The rubric stands on its own — grade yourself by hand against the scoring anchors and worked examples before you hit publish. Best case, you find out you're sitting on something special. Worst case, you find the prior art before a reviewer does.
Everything here is free and always will be. Two things keep it going:
- ⭐ Star the repository — the free one, and the one that actually helps. Stars are how researchers find this archive, and every one of them puts two decades of preserved research in front of someone who did not know it survived.
- 💛 Sponsor on GitHub — preservation is the
expensive part: hosting
webhacklist.comand a growing pile of PDFs, chasing dead domains through the Wayback Machine, recapturing broken snapshots, and curating each year by hand. One-off or recurring, any amount is genuinely useful.
Sponsorship buys no influence over the lists — entries are added on the evidence, never on who paid. Prefer to give time instead? Contributing is worth as much. Full details in SUPPORT.md.
The quickest route is the Submit research button on webhacklist.com — it searches the archive as you type, tells you straight away whether a source is already recorded, and then opens a GitHub issue with your answers already filled in. Full details, and the bar a missed technique has to clear, are in CONTRIBUTING.md.
| You want to | File this |
|---|---|
| Propose a technique a year's round missed | Submit research |
| Report a cited link that died or moved | Dead or wrong link |
| Report a preserved copy that captured the wrong page | Faulty archived copy |
| Fix a byline, or add a missing researcher | Researcher credit |
| Report a website bug or suggest something | Website bug or idea |
Pull requests are welcome for any of these too. A new technique still needs its
submission issue first — it is judged in full either way. And when a new year is
announced, add <year>.md, then extend tools/sources.json and run
python tools/capture_pdf.py run to archive the announcement pages.
- Jeremiah Grossman — created the list and curated 2006–2015.
- James Kettle and PortSwigger — curators since 2016.
- Every researcher behind the 1,500+ techniques collected here.
- Maintained by Soroush Dalili (@irsdl).