Web Exploitation
Active exploitation of the vulnerabilities you confirmed in analysis, to demonstrate impact and gain access. 54 guides, grouped into seven families — each with detailed techniques, automation scripts, and practice labs.
Warning
Start Here
New to web exploitation?Learn these eight first. They are the highest-frequency attacks, they need the least tooling, and everything else in this section builds on the instincts they teach.
- 01 SQL Injection The canonical injection flaw — teaches payload crafting end to end.
- 02 Cross-Site Scripting The most common web bug and the gateway to client-side risk.
- 03 IDOR The simplest access-control break — no tooling required.
- 04 Authentication Bypass How logins actually fail in the real world.
- 05 SSRF The pivot that reaches internal networks and cloud metadata.
- 06 CSRF State-changing requests and the defenses meant to stop them.
- 07 Command Injection From a single input to code execution on the server.
- 08 File Upload Turning an everyday feature into a web shell.
Injection
11Untrusted input reaching an interpreter as code, query, or markup. The oldest and most reliable class of web attack.
SQL Injection
beginnerUnion-based, blind Boolean/time-based, error-based SQLi. WAF bypasses and database-specific payloads.
NoSQL Injection
intermediateMongoDB operator injection, authentication bypass, data extraction, and blind injection.
OS Command Injection
beginnerCommand separators, blind injection, filter bypasses, and reverse shells for Linux/Windows.
Server-Side Template Injection
intermediateJinja2, Twig, Freemarker exploitation. Template detection, RCE payloads, and filter bypasses.
Expression Language Injection
advancedJava EL, Spring SpEL, OGNL, Jinja2, Twig, and Freemarker RCE chains with polyglot payloads.
XML External Entity (XXE)
intermediateFile disclosure, SSRF via XXE, blind XXE with OOB exfiltration, and SVG/DOCX injection.
LDAP Injection
intermediateAuthentication bypass, data extraction, blind LDAP injection, and modification attacks.
XPath Injection
intermediateAuthentication bypass, data extraction, blind XPath injection, and XML structure enumeration.
CRLF Injection
intermediateHTTP response splitting, XSS via CRLF, session fixation, log poisoning, and encoding variants.
Email Header Injection
intermediateCRLF in email headers, CC/BCC injection, content-type injection, and password reset token theft.
HTTP Parameter Pollution
intermediateFramework parsing differences, WAF bypass via HPP, business logic bypass, and server-side HPP.
Client-Side & Cross-Origin
8Attacks that execute in, or target, the victim’s browser — abusing trust between the page, the user, and other origins.
Cross-Site Scripting (XSS)
beginnerReflected, stored, and DOM-based XSS. Filter bypasses, CSP evasion, and BeEF integration.
Cross-Site Request Forgery
beginnerCSRF token bypass, SameSite cookie bypass, JSON CSRF, and PoC generation.
Client-Side Attacks
advancedDOM clobbering, postMessage abuse, service worker hijacking, CSS injection, and exfiltration.
Prototype Pollution
advancedClient-side and server-side exploitation, gadget chains, PP-to-XSS, and Node.js RCE.
Clickjacking
beginnerX-Frame-Options/CSP detection, PoC generation, multi-step UI redress, and frame-busting bypasses.
Open Redirect
beginnerURL validation bypasses, OAuth token theft, SSRF chains, and phishing enhancement.
CORS Misconfiguration
intermediateOrigin reflection, null origin bypass, wildcard with credentials, and regex bypass techniques.
WebSocket Security
intermediateCross-Site WebSocket Hijacking (CSWSH), message injection, and origin validation bypass.
Authentication & Session
7Breaking how an application proves who you are and keeps you logged in — credentials, tokens, SSO, and session lifecycle.
Authentication Bypass
beginnerDefault credentials, SQLi login bypass, JWT attacks, 2FA bypass, and OAuth/SAML attacks.
JWT Attacks
intermediateAlgorithm confusion, none algorithm bypass, weak secret cracking, and KID injection.
OAuth/OIDC Attacks
advancedRedirect URI manipulation, token leakage, PKCE bypass, and state parameter CSRF.
SAML / SSO Attacks
advancedSignature bypass, XML signature wrapping, assertion manipulation, and SSO relay attacks.
MFA Bypass Techniques
intermediateOTP brute force, response manipulation, push fatigue, token reuse, and evilginx2 phishing.
Session Fixation
intermediatePre-auth session assignment, URL-based fixation, cookie injection, and session ID regeneration testing.
Credential Stuffing & Account Enumeration
beginnerUsername enumeration via timing/message/size differences, Hydra/ffuf attacks, and rate limit bypass.
Access Control & Business Logic
4Flaws in what a user is allowed to do rather than how input is parsed — the category no scanner reliably finds.
IDOR
beginnerHorizontal/vertical privilege escalation, GUID prediction, parameter tampering, and automation.
Business Logic Vulnerabilities
intermediateWorkflow bypass, race conditions, payment manipulation, and rate limiting bypass.
Race Conditions
advancedTOCTOU exploitation, limit-overrun attacks, Turbo Intruder, and single-packet techniques.
Mass Assignment
intermediateFramework-specific attacks (Rails, Django, Laravel, Spring), nested object injection, and GraphQL mass assignment.
Server-Side Exploitation
9Flaws that hand you file access, internal network reach, or code execution on the server behind the application.
Server-Side Request Forgery
intermediateInternal network scanning, cloud metadata exploitation, DNS rebinding, and protocol smuggling.
File Upload Attacks
beginnerWeb shell uploads, extension bypasses, magic byte manipulation, and polyglot files.
Path Traversal / LFI / RFI
beginnerDirectory traversal, local/remote file inclusion, PHP wrappers, and log poisoning.
Insecure Deserialization
advancedJava (ysoserial), PHP (phpggc), Python (pickle), and .NET gadget chains with exploitation.
Host Header Injection
intermediatePassword reset poisoning, cache poisoning via host, virtual host enumeration, and SSRF chains.
Webhook Security
intermediateWebhook SSRF via cloud metadata, signature forgery, replay attacks, and callback manipulation.
PDF Generation Attacks
intermediateLocal file read via HTML-to-PDF, SSRF through PDF libraries, and data exfiltration techniques.
Secrets Exposure
beginnerHardcoded keys in JS/source maps, .env files, git mining with truffleHog/gitleaks, and regex patterns.
Information Disclosure
beginnerError page analysis, verbose headers, debug endpoints, source code exposure, and directory listing.
Protocol, Proxy & Cache
7Attacks on the HTTP layer itself and the infrastructure in front of the app — desync, caches, gateways, and WAFs.
HTTP Request Smuggling
advancedCL.TE, TE.CL, TE.TE desync attacks, HTTP/2 downgrade smuggling, and cache poisoning chains.
Web Cache Poisoning
advancedUnkeyed header injection, cache deception, Param Miner, and cache key manipulation.
Web Cache Deception
intermediatePath confusion techniques, CDN-specific testing, automated exploitation, and cache key analysis.
HTTP/2 & HTTP/3 Attacks
advancedH2 request smuggling, h2c smuggling, single-packet race conditions, and QUIC attack surface.
WAF Bypass
intermediateWAF detection, encoding tricks, SQLi/XSS/command injection evasion, and origin IP discovery.
API Gateway / Proxy Bypass
intermediatePath normalization bypass, direct backend access, header manipulation, and method override exploits.
Security Headers
beginnerCSP bypass, HSTS stripping, clickjacking via X-Frame-Options, and missing security headers.
APIs, Modern Stack & Config
8The surface that has grown fastest: API protocols, serverless, LLM features, and the configuration/dependency flaws around them.
REST API Attacks
intermediateOWASP API Top 10, BOLA/BFLA, JWT attacks, rate limiting bypass, and API versioning bugs.
GraphQL Security
intermediateIntrospection leakage, batching attacks, DoS via nested queries, and authorization bypass.
gRPC Security
advancedService discovery via reflection, authentication testing, injection in protobuf fields, and fuzzing.
Serverless Function Attacks
advancedEvent injection, environment/credential exposure, IAM privilege escalation, and cold start abuse.
Prompt Injection / LLM Attacks
intermediateDirect and indirect prompt injection, RAG poisoning, jailbreaking, and AI data extraction.
Vulnerable & Outdated Components
beginnerFingerprinting with Wappalyzer/WhatWeb, dependency analysis, Retire.js, Nuclei, and CVE exploitation.
Cryptographic Failures
intermediateTLS/SSL testing, weak password storage, data in transit/at rest analysis, and weak crypto detection.
Logging & Monitoring Failures
beginnerMissing log testing, log quality assessment, monitoring/alerting gaps, and audit trail analysis.
Quick Reference
Exploitation Methodology
- Identify vulnerability type - Confirm the vulnerability exists and understand its nature
- Research exploitation techniques - Use the detailed guides above for specific attack vectors
- Develop/customize payloads - Adapt payloads to bypass any security controls
- Demonstrate impact - Show real-world consequences (data access, RCE, etc.)
- Document everything - Screenshot evidence, save payloads, note exact steps
Information
Related Topics
Injection Remediation
Fix SQL and command injection vulnerabilities
XSS Remediation
Prevent cross-site scripting attacks
CSRF Remediation
Implement anti-CSRF protections
Access Control Remediation
Fix broken access control issues
Burp Suite Cheatsheet
Web testing proxy commands
SQLMap Cheatsheet
Automated SQL injection tool