irsdl/webhacklist preserves every nominee of the annual Top 10 Web Hacking Techniques since 2006 as searchable Markdown and PDF snapshots, serving as a reference library for authorized security professionals.

Some of the most valuable repositories in security are not scanners or proxies but archives, and irsdl/webhacklist is a strong argument for that thesis. The project, maintained by Soroush Dalili (irsdl), preserves the complete record of the annual Top 10 Web Hacking Techniques competition — the community vote started by Jeremiah Grossman in 2006 and continued today by James Kettle at PortSwigger. The repository sits at roughly 858 stars, is written primarily in Python for its tooling, and publishes a live, searchable version of the archive at webhacklist.com. Its educational framing is explicit: this is a documentary record of published research, not an attack toolkit.

The motivation is preservation. As the README notes, the announcement posts for these lists have a habit of disappearing — WhiteHat Security's blog, which hosted the 2011–2015 lists, is already gone. The archive counters that link rot in two ways. First, it maintains one Markdown file per year (2006.md through 2025.md) containing every nominated technique, not just the winners. Second, it stores PDF snapshots of the original nominee and winner announcement pages under original-listings/, with per-year files named like -nominees.pdf and -top10.pdf, each accompanied by provenance notes explaining the archive rationale.

The scale is what makes it genuinely useful as a professional reference. The README counts 1,136 officially nominated techniques across two decades, plus 423 research items the nomination rounds missed that were recovered by later audit, for a total of 1,559 techniques. The audit additions are deliberately kept visible and separate under a ## Missed from the original list heading in each year file, and candidate evaluations — Added or Not added decisions — are recorded under ai-evaluation//. That separation matters for anyone citing the archive: you can always tell what was on the original ballot versus what was backfilled by the maintainer.

Structurally, each year file follows one strict layout. It opens with a ## Top 10 section listing the ten winners in finishing order, each tagged with its rank (for example, a 2025 entry like Blind SSTI tagged #1), followed by ## Other nominations holding the unranked long tail in its original order. The README's own commentary is that the long tail is often where the genuinely novel work hides — a fair observation for anyone who has mined past nominations for techniques that never got mainstream adoption in scanners or training material.

The archive is also candid about the competition's internal politics, documenting four years where research was held out of the vote to avoid conflicts of interest. In 2019, James Kettle's HTTP Desync Attacks won the community vote outright but he declined to rank his own research first. In 2024 and 2025, PortSwigger entries that reached the final fifteen (Gotta cache 'em all, Splitting the email atom, Listen to the whispers, HTTP/1.1 must die) were held out of the panel vote. The 2016/17 round excluded PortSwigger research up front. Rather than let that work vanish, those entries sit at the top of ## Other nominations with notes explaining the situation — a level of editorial care you rarely see in community archives.

For an authorized practitioner, the practical use case is research grounding. If you are writing an assessment report, building internal training, or preparing a talk, the per-year tables give you a quick index: 2025's winner was Successful Errors with 67 nominations and 24 audit additions; 2024's was Confusion Attacks with a remarkable 119 nominations; earlier years catalogue era-defining work like Heartbleed (2014), BEAST (2011), CRIME (2012), Padding Oracle attacks (2010), and Mutation XSS (2013). Because everything is plain Markdown, the whole corpus is greppable — you can search for SSRF, OAuth, or cache poisoning across twenty years of technique evolution in seconds.

The Python component lives in tools/, and it is the part that makes the PDF archive reproducible rather than ad hoc. capture_pdf.py is a headless-Chrome capture driver paired with a verifier; sources.json acts as a manifest declaring what to capture, from where, and with what assertions; and capture-report.json logs the provenance of the last run. This is a small but well-designed archival pipeline — deterministic capture driven by a declarative manifest, with a machine-readable audit trail. Anyone building their own documentation pipelines could do worse than copy the pattern.

There is also an experimental seam worth noting. Files named -ai.md hold machine-assembled candidate lists for years that have not yet had a community vote, kept deliberately separate from the curated lists, with the full evaluation history under ai-evaluation/. This is a sensible trust boundary: AI-collected candidates are treated as unverified input until they pass the maintainer's review, and the README invites corrections via issues and pull requests for anything that qualifies as a nominee for a given year.

Where this fits in an authorized workflow is straightforward: it is a study and reference asset, not an operational tool. Defenders can use it to understand which classes of web vulnerability gained traction in research over time and check whether their detection coverage matches the historical trend line; pentesters preparing for engagements in scope and contract can use it as a taxonomy of technique categories to consider; trainers can mine it for case studies. Nothing in the repository executes attacks against systems — it contains names, links, and preserved documents.

Two small caveats before you rely on it. Many outbound links in the older year files are dead, and the README itself recommends pasting them into the Wayback Machine or consulting the PDF archive for the announcement pages. And because the early lists predate modern hosting, some entries exist only through those preserved PDFs — so if you are citing the archive, cite the repository rather than the original URLs. As a durable, greppable record of twenty years of web security research, irsdl/webhacklist is the kind of public good that deserves a star and, more importantly, contributions from anyone who remembers research the original rounds missed.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• Inside ESP32-BlueJammer: how a $10 dev board floods the entire 2.4GHz band


• Inside ad_attack_architecture: mapping the Active Directory attack path from recon to domain dominance


• Inside EBurst: credential auditing across Exchange endpoints