| sql-injection |
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data] |
Link |
| sql-injection |
SQL injection vulnerability allowing login bypass] |
Link |
| sql-injection |
SQL injection attack, querying the database type and version on Oracle] |
Link |
| sql-injection |
SQL injection attack, querying the database type and version on MySQL and Microsoft] |
Link |
| sql-injection |
SQL injection attack, listing the database contents on non-Oracle databases] |
Link |
| sql-injection |
SQL injection attack, listing the database contents on Oracle] |
Link |
| sql-injection |
SQL injection UNION attack, determining the number of columns returned by the query] |
Link |
| sql-injection |
SQL injection UNION attack, finding a column containing text] |
Link |
| sql-injection |
SQL injection UNION attack, retrieving data from other tables] |
Link |
| sql-injection |
SQL injection UNION attack, retrieving multiple values in a single column] |
Link |
| sql-injection |
Blind SQL injection with conditional responses] |
Link |
| sql-injection |
Blind SQL injection with conditional errors] |
Link |
| sql-injection |
Visible error-based SQL injection] |
Link |
| sql-injection |
Blind SQL injection with time delays] |
Link |
| sql-injection |
Blind SQL injection with time delays and information retrieval] |
Link |
| sql-injection |
Blind SQL injection with out-of-band interaction] |
Link |
| sql-injection |
Blind SQL injection with out-of-band data exfiltration] |
Link |
| sql-injection |
SQL injection with filter bypass via XML encoding] |
Link |
| cross-site-scripting |
Reflected XSS into HTML context with nothing encoded] |
Link |
| cross-site-scripting |
Stored XSS into HTML context with nothing encoded] |
Link |
| cross-site-scripting |
DOM XSS in document.write sink using source location.search] |
Link |
| cross-site-scripting |
DOM XSS in innerHTML sink using source location.search] |
Link |
| cross-site-scripting |
DOM XSS in jQuery anchor href attribute sink using location.search source] |
Link |
| cross-site-scripting |
DOM XSS in jQuery selector sink using a hashchange event] |
Link |
| cross-site-scripting |
Reflected XSS into attribute with angle brackets HTML-encoded] |
Link |
| cross-site-scripting |
Stored XSS into anchor href attribute with double quotes HTML-encoded] |
Link |
| cross-site-scripting |
Reflected XSS into a JavaScript string with angle brackets HTML encoded] |
Link |
| cross-site-scripting |
DOM XSS in document.write sink using source location.search inside a select element] |
Link |
| cross-site-scripting |
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded] |
Link |
| cross-site-scripting |
Reflected DOM XSS] |
Link |
| cross-site-scripting |
Stored DOM XSS] |
Link |
| cross-site-scripting |
Reflected XSS into HTML context with most tags and attributes blocked] |
Link |
| cross-site-scripting |
Reflected XSS into HTML context with all tags blocked except custom ones] |
Link |
| cross-site-scripting |
Reflected XSS with some SVG markup allowed] |
Link |
| cross-site-scripting |
Reflected XSS in canonical link tag] |
Link |
| cross-site-scripting |
Reflected XSS into a JavaScript string with single quote and backslash escaped] |
Link |
| cross-site-scripting |
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped] |
Link |
| cross-site-scripting |
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped] |
Link |
| cross-site-scripting |
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped] |
Link |
| cross-site-scripting |
Exploiting cross-site scripting to steal cookies] |
Link |
| cross-site-scripting |
Exploiting cross-site scripting to capture passwords] |
Link |
| cross-site-scripting |
Exploiting XSS to bypass CSRF defenses] |
Link |
| cross-site-scripting |
Reflected XSS with AngularJS sandbox escape without strings] |
Link |
| cross-site-scripting |
Reflected XSS with AngularJS sandbox escape and CSP] |
Link |
| cross-site-scripting |
Reflected XSS with event handlers and href attributes blocked] |
Link |
| cross-site-scripting |
Reflected XSS in a JavaScript URL with some characters blocked] |
Link |
| cross-site-scripting |
Reflected XSS protected by very strict CSP, with dangling markup attack] |
Link |
| cross-site-scripting |
Reflected XSS protected by CSP, with CSP bypass] |
Link |
| cross-site-request-forgery-csrf |
CSRF vulnerability with no defenses] |
Link |
| cross-site-request-forgery-csrf |
CSRF where token validation depends on request method] |
Link |
| cross-site-request-forgery-csrf |
CSRF where token validation depends on token being present] |
Link |
| cross-site-request-forgery-csrf |
CSRF where token is not tied to user session] |
Link |
| cross-site-request-forgery-csrf |
CSRF where token is tied to non-session cookie] |
Link |
| cross-site-request-forgery-csrf |
CSRF where token is duplicated in cookie] |
Link |
| cross-site-request-forgery-csrf |
SameSite Lax bypass via method override] |
Link |
| cross-site-request-forgery-csrf |
SameSite Strict bypass via client-side redirect] |
Link |
| cross-site-request-forgery-csrf |
SameSite Strict bypass via sibling domain] |
Link |
| cross-site-request-forgery-csrf |
SameSite Lax bypass via cookie refresh] |
Link |
| cross-site-request-forgery-csrf |
CSRF where Referer validation depends on header being present] |
Link |
| cross-site-request-forgery-csrf |
CSRF with broken Referer validation] |
Link |
| clickjacking |
Basic clickjacking with CSRF token protection] |
Link |
| clickjacking |
Clickjacking with form input data prefilled from a URL parameter] |
Link |
| clickjacking |
Clickjacking with a frame buster script] |
Link |
| clickjacking |
Exploiting clickjacking vulnerability to trigger DOM-based XSS] |
Link |
| clickjacking |
Multistep clickjacking] |
Link |
| dom-based-vulnerabilities |
DOM XSS using web messages] |
Link |
| dom-based-vulnerabilities |
DOM XSS using web messages and a JavaScript URL] |
Link |
| dom-based-vulnerabilities |
DOM XSS using web messages and JSON.parse] |
Link |
| dom-based-vulnerabilities |
DOM-based open redirection] |
Link |
| dom-based-vulnerabilities |
DOM-based cookie manipulation] |
Link |
| dom-based-vulnerabilities |
Exploiting DOM clobbering to enable XSS] |
Link |
| dom-based-vulnerabilities |
Clobbering DOM attributes to bypass HTML filters] |
Link |
| cross-origin-resource-sharing-cors |
CORS vulnerability with basic origin reflection] |
Link |
| cross-origin-resource-sharing-cors |
CORS vulnerability with trusted null origin] |
Link |
| cross-origin-resource-sharing-cors |
CORS vulnerability with trusted insecure protocols] |
Link |
| xml-external-entity-xxe-injection |
Exploiting XXE using external entities to retrieve files] |
Link |
| xml-external-entity-xxe-injection |
Exploiting XXE to perform SSRF attacks] |
Link |
| xml-external-entity-xxe-injection |
Blind XXE with out-of-band interaction] |
Link |
| xml-external-entity-xxe-injection |
Blind XXE with out-of-band interaction via XML parameter entities] |
Link |
| xml-external-entity-xxe-injection |
Exploiting blind XXE to exfiltrate data using a malicious external DTD] |
Link |
| xml-external-entity-xxe-injection |
Exploiting blind XXE to retrieve data via error messages] |
Link |
| xml-external-entity-xxe-injection |
Exploiting XInclude to retrieve files] |
Link |
| xml-external-entity-xxe-injection |
Exploiting XXE via image file upload] |
Link |
| xml-external-entity-xxe-injection |
Exploiting XXE to retrieve data by repurposing a local DTD] |
Link |
| server-side-request-forgery-ssrf |
Basic SSRF against the local server] |
Link |
| server-side-request-forgery-ssrf |
Basic SSRF against another back-end system] |
Link |
| server-side-request-forgery-ssrf |
Blind SSRF with out-of-band detection] |
Link |
| server-side-request-forgery-ssrf |
SSRF with blacklist-based input filter] |
Link |
| server-side-request-forgery-ssrf |
SSRF with filter bypass via open redirection vulnerability] |
Link |
| server-side-request-forgery-ssrf |
Blind SSRF with Shellshock exploitation] |
Link |
| server-side-request-forgery-ssrf |
SSRF with whitelist-based input filter] |
Link |
| http-request-smuggling |
HTTP request smuggling, confirming a CL.TE vulnerability via differential responses] |
Link |
| http-request-smuggling |
HTTP request smuggling, confirming a TE.CL vulnerability via differential responses] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to reveal front-end request rewriting] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to capture other users' requests] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to deliver reflected XSS] |
Link |
| http-request-smuggling |
Response queue poisoning via H2.TE request smuggling] |
Link |
| http-request-smuggling |
H2.CL request smuggling] |
Link |
| http-request-smuggling |
HTTP/2 request smuggling via CRLF injection] |
Link |
| http-request-smuggling |
HTTP/2 request splitting via CRLF injection] |
Link |
| http-request-smuggling |
0.CL request smuggling] |
Link |
| http-request-smuggling |
CL.0 request smuggling] |
Link |
| http-request-smuggling |
HTTP request smuggling, basic CL.TE vulnerability] |
Link |
| http-request-smuggling |
HTTP request smuggling, basic TE.CL vulnerability] |
Link |
| http-request-smuggling |
HTTP request smuggling, obfuscating the TE header] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to perform web cache poisoning] |
Link |
| http-request-smuggling |
Exploiting HTTP request smuggling to perform web cache deception] |
Link |
| http-request-smuggling |
Bypassing access controls via HTTP/2 request tunnelling] |
Link |
| http-request-smuggling |
Web cache poisoning via HTTP/2 request tunnelling] |
Link |
| http-request-smuggling |
Client-side desync] |
Link |
| http-request-smuggling |
Server-side pause-based request smuggling] |
Link |
| os-command-injection |
OS command injection, simple case] |
Link |
| os-command-injection |
Blind OS command injection with time delays] |
Link |
| os-command-injection |
Blind OS command injection with output redirection] |
Link |
| os-command-injection |
Blind OS command injection with out-of-band interaction] |
Link |
| os-command-injection |
Blind OS command injection with out-of-band data exfiltration] |
Link |
| server-side-template-injection |
Basic server-side template injection] |
Link |
| server-side-template-injection |
Basic server-side template injection (code context)] |
Link |
| server-side-template-injection |
Server-side template injection using documentation] |
Link |
| server-side-template-injection |
Server-side template injection in an unknown language with a documented exploit] |
Link |
| server-side-template-injection |
Server-side template injection with information disclosure via user-supplied objects] |
Link |
| server-side-template-injection |
Server-side template injection in a sandboxed environment] |
Link |
| server-side-template-injection |
Server-side template injection with a custom exploit] |
Link |
| path-traversal |
File path traversal, simple case] |
Link |
| path-traversal |
File path traversal, traversal sequences blocked with absolute path bypass] |
Link |
| path-traversal |
File path traversal, traversal sequences stripped non-recursively] |
Link |
| path-traversal |
File path traversal, traversal sequences stripped with superfluous URL-decode] |
Link |
| path-traversal |
File path traversal, validation of start of path] |
Link |
| path-traversal |
File path traversal, validation of file extension with null byte bypass] |
Link |
| access-control-vulnerabilities |
Unprotected admin functionality] |
Link |
| access-control-vulnerabilities |
Unprotected admin functionality with unpredictable URL] |
Link |
| access-control-vulnerabilities |
User role controlled by request parameter] |
Link |
| access-control-vulnerabilities |
User role can be modified in user profile] |
Link |
| access-control-vulnerabilities |
User ID controlled by request parameter] |
Link |
| access-control-vulnerabilities |
User ID controlled by request parameter, with unpredictable user IDs] |
Link |
| access-control-vulnerabilities |
User ID controlled by request parameter with data leakage in redirect] |
Link |
| access-control-vulnerabilities |
User ID controlled by request parameter with password disclosure] |
Link |
| access-control-vulnerabilities |
Insecure direct object references] |
Link |
| access-control-vulnerabilities |
URL-based access control can be circumvented] |
Link |
| access-control-vulnerabilities |
Method-based access control can be circumvented] |
Link |
| access-control-vulnerabilities |
Multi-step process with no access control on one step] |
Link |
| access-control-vulnerabilities |
Referer-based access control] |
Link |
| authentication |
Username enumeration via different responses] |
Link |
| authentication |
2FA simple bypass] |
Link |
| authentication |
Password reset broken logic] |
Link |
| authentication |
Username enumeration via subtly different responses] |
Link |
| authentication |
Username enumeration via response timing] |
Link |
| authentication |
Broken brute-force protection, IP block] |
Link |
| authentication |
Username enumeration via account lock] |
Link |
| authentication |
2FA broken logic] |
Link |
| authentication |
Brute-forcing a stay-logged-in cookie] |
Link |
| authentication |
Offline password cracking] |
Link |
| authentication |
Password reset poisoning via middleware] |
Link |
| authentication |
Password brute-force via password change] |
Link |
| authentication |
Broken brute-force protection, multiple credentials per request] |
Link |
| authentication |
2FA bypass using a brute-force attack] |
Link |
| websockets |
Manipulating WebSocket messages to exploit vulnerabilities] |
Link |
| websockets |
Cross-site WebSocket hijacking] |
Link |
| websockets |
Manipulating the WebSocket handshake to exploit vulnerabilities] |
Link |
| web-cache-poisoning |
Web cache poisoning with an unkeyed header] |
Link |
| web-cache-poisoning |
Web cache poisoning with an unkeyed cookie] |
Link |
| web-cache-poisoning |
Web cache poisoning with multiple headers] |
Link |
| web-cache-poisoning |
Targeted web cache poisoning using an unknown header] |
Link |
| web-cache-poisoning |
Web cache poisoning via an unkeyed query string] |
Link |
| web-cache-poisoning |
Web cache poisoning via an unkeyed query parameter] |
Link |
| web-cache-poisoning |
Parameter cloaking] |
Link |
| web-cache-poisoning |
Web cache poisoning via a fat GET request] |
Link |
| web-cache-poisoning |
URL normalization] |
Link |
| web-cache-poisoning |
Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria] |
Link |
| web-cache-poisoning |
Combining web cache poisoning vulnerabilities] |
Link |
| web-cache-poisoning |
Cache key injection] |
Link |
| web-cache-poisoning |
Internal cache poisoning] |
Link |
| insecure-deserialization |
Modifying serialized objects] |
Link |
| insecure-deserialization |
Modifying serialized data types] |
Link |
| insecure-deserialization |
Using application functionality to exploit insecure deserialization] |
Link |
| insecure-deserialization |
Arbitrary object injection in PHP] |
Link |
| insecure-deserialization |
Exploiting Java deserialization with Apache Commons] |
Link |
| insecure-deserialization |
Exploiting PHP deserialization with a pre-built gadget chain] |
Link |
| insecure-deserialization |
Exploiting Ruby deserialization using a documented gadget chain] |
Link |
| insecure-deserialization |
Developing a custom gadget chain for Java deserialization] |
Link |
| insecure-deserialization |
Developing a custom gadget chain for PHP deserialization] |
Link |
| insecure-deserialization |
Using PHAR deserialization to deploy a custom gadget chain] |
Link |
| information-disclosure |
Information disclosure in error messages] |
Link |
| information-disclosure |
Information disclosure on debug page] |
Link |
| information-disclosure |
Source code disclosure via backup files] |
Link |
| information-disclosure |
Authentication bypass via information disclosure] |
Link |
| information-disclosure |
Information disclosure in version control history] |
Link |
| business-logic-vulnerabilities |
Excessive trust in client-side controls] |
Link |
| business-logic-vulnerabilities |
High-level logic vulnerability] |
Link |
| business-logic-vulnerabilities |
Inconsistent security controls] |
Link |
| business-logic-vulnerabilities |
Flawed enforcement of business rules] |
Link |
| business-logic-vulnerabilities |
Low-level logic flaw] |
Link |
| business-logic-vulnerabilities |
Inconsistent handling of exceptional input] |
Link |
| business-logic-vulnerabilities |
Weak isolation on dual-use endpoint] |
Link |
| business-logic-vulnerabilities |
Insufficient workflow validation] |
Link |
| business-logic-vulnerabilities |
Authentication bypass via flawed state machine] |
Link |
| business-logic-vulnerabilities |
Infinite money logic flaw] |
Link |
| business-logic-vulnerabilities |
Authentication bypass via encryption oracle] |
Link |
| business-logic-vulnerabilities |
Bypassing access controls using email address parsing discrepancies] |
Link |
| http-host-header-attacks |
Basic password reset poisoning] |
Link |
| http-host-header-attacks |
Host header authentication bypass] |
Link |
| http-host-header-attacks |
Web cache poisoning via ambiguous requests] |
Link |
| http-host-header-attacks |
Routing-based SSRF] |
Link |
| http-host-header-attacks |
SSRF via flawed request parsing] |
Link |
| http-host-header-attacks |
Host validation bypass via connection state attack] |
Link |
| http-host-header-attacks |
Password reset poisoning via dangling markup] |
Link |
| oauth-authentication |
Authentication bypass via OAuth implicit flow] |
Link |
| oauth-authentication |
SSRF via OpenID dynamic client registration] |
Link |
| oauth-authentication |
Forced OAuth profile linking] |
Link |
| oauth-authentication |
OAuth account hijacking via redirect_uri] |
Link |
| oauth-authentication |
Stealing OAuth access tokens via an open redirect] |
Link |
| oauth-authentication |
Stealing OAuth access tokens via a proxy page] |
Link |
| file-upload-vulnerabilities |
Remote code execution via web shell upload] |
Link |
| file-upload-vulnerabilities |
Web shell upload via Content-Type restriction bypass] |
Link |
| file-upload-vulnerabilities |
Web shell upload via path traversal] |
Link |
| file-upload-vulnerabilities |
Web shell upload via extension blacklist bypass] |
Link |
| file-upload-vulnerabilities |
Web shell upload via obfuscated file extension] |
Link |
| file-upload-vulnerabilities |
Remote code execution via polyglot web shell upload] |
Link |
| file-upload-vulnerabilities |
Web shell upload via race condition] |
Link |
| jwt |
JWT authentication bypass via unverified signature] |
Link |
| jwt |
JWT authentication bypass via flawed signature verification] |
Link |
| jwt |
JWT authentication bypass via weak signing key] |
Link |
| jwt |
JWT authentication bypass via jwk header injection] |
Link |
| jwt |
JWT authentication bypass via jku header injection] |
Link |
| jwt |
JWT authentication bypass via kid header path traversal] |
Link |
| jwt |
JWT authentication bypass via algorithm confusion] |
Link |
| jwt |
JWT authentication bypass via algorithm confusion with no exposed key] |
Link |
| essential-skills |
Discovering vulnerabilities quickly with targeted scanning] |
Link |
| essential-skills |
Scanning non-standard data structures] |
Link |
| prototype-pollution |
Client-side prototype pollution via browser APIs] |
Link |
| prototype-pollution |
DOM XSS via client-side prototype pollution] |
Link |
| prototype-pollution |
DOM XSS via an alternative prototype pollution vector] |
Link |
| prototype-pollution |
Client-side prototype pollution via flawed sanitization] |
Link |
| prototype-pollution |
Client-side prototype pollution in third-party libraries] |
Link |
| prototype-pollution |
Privilege escalation via server-side prototype pollution] |
Link |
| prototype-pollution |
Detecting server-side prototype pollution without polluted property reflection] |
Link |
| prototype-pollution |
Bypassing flawed input filters for server-side prototype pollution] |
Link |
| prototype-pollution |
Remote code execution via server-side prototype pollution] |
Link |
| prototype-pollution |
Exfiltrating sensitive data via server-side prototype pollution] |
Link |
| graphql-api-vulnerabilities |
Accessing private GraphQL posts] |
Link |
| graphql-api-vulnerabilities |
Accidental exposure of private GraphQL fields] |
Link |
| graphql-api-vulnerabilities |
Finding a hidden GraphQL endpoint] |
Link |
| graphql-api-vulnerabilities |
Bypassing GraphQL brute force protections] |
Link |
| graphql-api-vulnerabilities |
Performing CSRF exploits over GraphQL] |
Link |
| race-conditions |
Limit overrun race conditions] |
Link |
| race-conditions |
Bypassing rate limits via race conditions] |
Link |
| race-conditions |
Multi-endpoint race conditions] |
Link |
| race-conditions |
Single-endpoint race conditions] |
Link |
| race-conditions |
Exploiting time-sensitive vulnerabilities] |
Link |
| race-conditions |
Partial construction race conditions] |
Link |
| nosql-injection |
Detecting NoSQL injection] |
Link |
| nosql-injection |
Exploiting NoSQL operator injection to bypass authentication] |
Link |
| nosql-injection |
Exploiting NoSQL injection to extract data] |
Link |
| nosql-injection |
Exploiting NoSQL operator injection to extract unknown fields] |
Link |
| api-testing |
Exploiting an API endpoint using documentation] |
Link |
| api-testing |
Exploiting server-side parameter pollution in a query string] |
Link |
| api-testing |
Finding and exploiting an unused API endpoint] |
Link |
| api-testing |
Exploiting a mass assignment vulnerability] |
Link |
| api-testing |
Exploiting server-side parameter pollution in a REST URL] |
Link |
| web-llm-attacks |
Exploiting LLM APIs with excessive agency] |
Link |
| web-llm-attacks |
Exploiting vulnerabilities in LLM APIs] |
Link |
| web-llm-attacks |
Indirect prompt injection] |
Link |
| web-llm-attacks |
Exploiting insecure output handling in LLMs] |
Link |
| web-cache-deception |
Exploiting path mapping for web cache deception] |
Link |
| web-cache-deception |
Exploiting path delimiters for web cache deception] |
Link |
| web-cache-deception |
Exploiting origin server normalization for web cache deception] |
Link |
| web-cache-deception |
Exploiting cache server normalization for web cache deception] |
Link |
| web-cache-deception |
Exploiting exact-match cache rules for web cache deception] |
Link |
1fc7c4477e