Jeremiah Grossman, RSnake and Robert Augerand have put together an interesting collection of web application hacks discovered in 2006.

Top 10
1. Web Browser Intranet Hacking / Port Scanning – (with JavaScript and with HTML-only and the improved model)
2. Internet Explorer 7 “mhtml:” Redirection Information Disclosure
3. Anti-DNS Pinning and Circumventing Anti-Anti DNS pinning
4. Web Browser History Stealing – (with CSS, evil marketing, JS login-detection, and authenticated images)
5. Backdooring Media Files (QuickTime, Flash, PDF, Images, Word [2], and MP3′s)
6. Forging HTTP request headers with Flash
7. Exponential XSS
8. Encoding Filter Bypass (UTF-7, Variable Width, US-ASCII)
9. Web Worms – (AdultSpace, MySpace, Xanga)
10. Hacking RSS Feeds

Check out the original post here