Bookmark This: The Web Hacking Techniques Index — Two Decades of Research, Preserved

Every so often a resource is good enough that the most useful thing we can do is point you straight at it. webhacklist.com — the Web Hacking Techniques Index — is one of those: a free, open archive of 1,100+ web-hacking techniques from 2006 to today, each one preserved so the research doesn’t vanish when the blog that published it goes dark.

To be clear up front: PlayCISO didn’t build this. We’re recommending someone else’s excellent work, and we’ve added it to our Learn library so it’s easy to find later.

What it is

For years the web-security community has nominated the year’s most innovative research and voted on a Top 10 Web Hacking Techniques. Jeremiah Grossman started and curated that list from 2006 to 2015; James Kettle and PortSwigger have curated it since 2016. The problem: a lot of that research lived on personal blogs and company sites that have since gone offline. webhacklist.com (maintained by Soroush Dalili, @irsdl, on GitHub) rebuilt the whole thing as a preserved archive. Its tagline says it plainly: “Two decades of web hacking research, preserved before its hosts disappear.”

Each technique gets a catalogue record with a Markdown and PDF copy and a link to the original source — and a large share were pulled back from the Wayback Machine because the original page no longer answers. That preservation is the quiet, valuable part: link rot eats security research faster than almost any other field.

How to get around it

The archive is presented through several views, which is where the #museum anchor you may have landed on comes in:

• Investigation Board — a corkboard per year, good for seeing a single year’s standout research at a glance.
• Museum — themed “exhibition rooms” that group techniques for browsing rather than searching.
• Library — the “reading stacks” view for working through the catalogue.
• Time Machine — research through time, ideal for watching a bug class evolve.
• Signals & Constellation — a trend observatory and a relationship map that connects related techniques.
• Hacker Terminal — a query console for people who’d rather search than browse.

It’s free, it stays free, and browsing needs no account — a GitHub login is only needed to submit a technique or flag an inaccuracy.

How a security team should actually use it

As a learning spine. Pick a bug class — SSRF, HTTP request smuggling, deserialization, or the newer web-layer prompt-injection work — and read how it actually evolved year over year. You come away understanding the shape of a vulnerability class, not just one CVE.

As a defence checklist. Map the notable techniques to what your own stack exposes, then feed the ones that apply into your threat model and your test plan. “Has anyone checked whether this class applies to us?” is a far better review question than “are we patched?”

That second use is exactly where it plugs into the work we build here: take a technique that worries you, drop your system into the Threat Model Studio to see where it would land, and — if it’s an AI-adjacent web surface — run the injection patterns through PromptScan. The archive tells you what attackers have figured out; the point is to check it against what you ship. For more free, curated resources like this one, the full Learn library is the place to browse.

Credit where it’s due: the Web Hacking Techniques Index is the work of its curators and maintainer, not PlayCISO. Details here reflect the site as of October 2026; visit webhacklist.com for the current archive.