Welcome to the Top 10 (novel) Web Hacking Techniques of 2020, our annual community-powered effort to identify the must-read web security research released in the previous year.

Over the past few weeks, we've seen the community nominate 54 innovative papers, posts and presentations, then cast their votes to whittle the list down to 15 potential candidates. Finally, an expert panel consisting of Nicolas Grégoire, Soroush Dalili, Filedescriptor, and myself have voted in the 15 finalists to create the official top 10.

We've seen an undeniable increase in quality research since 2019, making the community vote even more competitive that usual. Numerous respectable posts didn't make the final 15; some that narrowly missed out include Secret Fragments, AST Injection, XSS without arbitrary JavaScript, and my own Web Cache Entanglement amid countless others.

Other than the overall improved quality, two other themes stood out this year. The community vote demonstrated a strong interest in novel attacks exploiting proxies and multi-layered architectures; including follow-ups to HTTP Desync Attacks and some exciting novel techniques which we'll see shortly. We also observed that the best attack research is increasingly dipping below the application layer, whether it's abusing TLS, chunked encoding, PDF internals or packet fragmentation.

Without further ado, let's begin the countdown.

In this post, Alex targets the notorious ImageMagick library, twisting its vast array of features to create a polyglot that, with the help of a somewhat malicious bug report, gets RCE.

The research discovery process is often glossed over and at risk of seeming a bit magical to outsiders, but Alex does a great job of covering his discovery journey, making this post valuable for people looking to get into research as well as those of us who just want a shell.

The panel was a bit conflicted about whether Nat Slipstreaming qualifies as a web hacking technique, but we had no doubts about the quality of the research.

Samy Kamkar used IP fragmentation to trick routers into interpreting part of a browser-issued HTTP request as a SIP packet and opening up the victim's NAT. This cross-layer, cross-discipline attack beautifully demonstrates the value of familiarity with underlying protocols and adjacent fields.

SSRF often has a critical impact, but if there's no convenient web services to target with it, it can appear frustratingly harmless. When TLS Hacks You is an SNI injection-inspired technique by Joshua Maddux which elegantly combines DNS rebinding and TLS session resumption to exploit internal services that don't speak HTTP. As filedescriptor put it, he brought gopher:// back!

This is essential reading for anyone stuck with an SSRF, and we're looking forward to seeing this technique appearing in exploit writeups in future.

Everyone knows what happens if you embed user input in HTML without encoding it, and in recent years people have also exploited servers that render user-uploaded PDFs using HTML. However, thanks to PDF's horrifying markup, nobody has publicly explored what happens when user input is embedded in a PDF, until now. In Portable Data exFiltration, Gareth Heyes tackles the format and stretches PDF parsers to go from PDF link injection to document theft, JavaScript execution and SSRF.

Needless to say I didn't vote for this myself due to a conflict of interest.

Given that no browsers support it, you could almost forget that HTTP/2 cleartext (H2C) exists, right up until Jake Miller unveiled H2C Smuggling. This is an all-new technique that abuses H2C-unware front-ends to create a tunnel to backend systems, enabling attackers to bypass front-end rewrite rules and exploit internal HTTP headers.

It's conceptually similar to the previous year's WebSocket Smuggling but looks significantly more practical. Request tunneling exploitation is an emerging art so this one may be a slow burn, but we anticipate some serious carnage in future.

Ultimately this research proves that, just like Gopher, this already-obsolete protocol is a gift to attackers. Massive congratulations to Jake Miller and Bishop Fox on a well-deserved winner!