</>   KNOWLEDGE AREA

Web exploitation

Trust boundaries, parsers, and application attack surfaces.

31 topics

Webadvanced

Blind file reads through filter-induced error oracles

Turn a nonprinting file read into a measured predicate while accounting for memory limits and filter errors.

phpblind-readoracle
Webadvanced

Browser connection pools as a desync boundary

Confirm leftover request bytes inside a real browser before claiming client-side desynchronization impact.

browserclient-side-desynchttp1
Webadvanced

Cache keys define exploitable equivalence classes

Prove an origin input is absent from the cache key and produces a response reusable by another request.

cache-poisoningcache-keyunkeyed-input
Webintermediate

Command injection and process argument boundaries

Command injection mixes data with shell syntax.

command-injectionweb
Webintermediate

CORS and cross-origin response access

CORS lets a server permit browser scripts from another origin to read responses.

cors-policyweb
Webintermediate

Cross-site request forgery and ambient browser credentials

CSRF causes a browser to submit an unwanted state-changing request while attaching credentials the destination normally trusts.

cross-site-request-forgeryweb
Webintermediate

Cross-site scripting and browser execution contexts

Cross-site scripting transfers untrusted data into an executable browser context.

cross-site-scriptingweb
Webintermediate

CSP: directive coverage, nonces, and browser enforcement

Content Security Policy restricts selected browser resource loads and script execution.

content-security-policyweb
Webintermediate

File uploads, polyglots, and storage execution boundaries

Upload vulnerabilities arise when validation, storage, and later consumption disagree about file meaning.

file-upload-boundariesweb
Webintermediate

GraphQL schema discovery, batching, and resolver authorization

GraphQL exposes typed operations whose fields are resolved by application code.

graphql-authorizationweb
Webadvanced

HTTP request smuggling and message framing

Smuggling requires two HTTP parsers to disagree about where one request ends and the next begins.

http-request-smugglingweb
Webadvanced

HTTP/2 downgrade framing disagreements

Audit the translation boundary between frame lengths and HTTP/1 body delimiters.

http2request-smugglingdesync
Webintermediate

JWT validation, algorithm policy, and claim semantics

A JWT is an encoded claims object with a signature or MAC, not automatically an encrypted message.

jwt-validationweb
Webintermediate

NoSQL injection: operators and query-shape control

NoSQL injection can alter query syntax or inject operator objects where an application expects a scalar.

nosql-injectionweb
Webintermediate

OAuth redirect binding, state, and authorization-code handling

OAuth delegates access through a client, authorization server, resource server, and user.

oauth-flowsweb
Webintermediate

Object authorization and workflow access control

Authentication identifies a caller; authorization decides whether that caller may perform a particular action on a particular object.

access-controlweb
Webintermediate

Open redirects and destination-policy consequences

An open redirect sends a client to an attacker-chosen destination through a trusted application URL.

open-redirectsweb
Webadvanced

Paired response ordering as a timing oracle

Control order bias and internal noise before interpreting HTTP/2 response races.

timingside-channelhttp2
Webadvanced

Path parser disagreement and cache deception

Compare cache admission, cache key normalization, and origin routing as three distinct URL interpretations.

cache-deceptionurl-parsingnormalization
Webintermediate

Path traversal and canonicalization boundaries

Traversal happens when an attacker-controlled path escapes an intended filesystem root.

path-traversalweb
Webadvanced

PHP filter chains as byte transducers

Reason about composable encoding transforms and prove suffix preservation before assembling a chain.

phpstream-filtersiconv
Webintermediate

postMessage: origin checks and message-driven sinks

Window messaging crosses origin boundaries explicitly.

postmessageweb
Webadvanced

Prototype pollution through module-loader fallbacks

Trace inherited defaults into a runtime-specific module loading gadget and distinguish loading from execution.

prototype-pollutionnodejsgadgets
Webintermediate

Prototype pollution: source, propagation, and gadget

JavaScript property lookups can inherit values through the prototype chain.

prototype-pollutionweb
Webadvanced

Race hidden authentication and workflow substates

Find transient invariant violations inside one request and control synchronization without assuming atomic handlers.

race-conditionsstate-machinehttp2
Webintermediate

Server-side request forgery and URL resolution

SSRF turns a server-side fetch capability into a request to an unintended destination.

server-side-request-forgeryweb
Webintermediate

Server-side template injection and expression evaluation

Template injection occurs when untrusted input becomes template source rather than a value supplied to a fixed template.

template-injectionweb
Webintermediate

SQL injection: context, errors, and inference

An injection exists when application data changes the grammar of a database statement.

sql-injectionweb
Webintermediate

Unsafe deserialization and object-construction side effects

Deserialization turns bytes into program values and sometimes invokes constructors, hooks, or dynamic type loading.

unsafe-deserializationweb
Webadvanced

Web race conditions and atomic business invariants

Web races occur when concurrent operations observe shared state and violate an invariant that should be enforced atomically.

web-race-conditionsweb
Webintermediate

XML external entities and parser resource resolution

An XML parser can process a document type definition and resolve external entities into document content.

xml-external-entitiesweb