web

Web

Application-layer vulnerability cheatsheets — detection, exploitation, bypass, and remediation guidance for each class. Sources cite OWASP WSTG, PortSwigger Academy, OWASP Cheat Sheet Series, PayloadsAllTheThings, and HackTricks.

Index

File	WSTG	MITRE ATT&CK
cache-deception.md	—	—
checklist.md	WSTG v4.2	—
command-injection.md	WSTG-INPV-12	T1059 Command and Scripting Interpreter
cors.md	WSTG-CLNT-07	—
crlf-header-injection.md	WSTG-INPV-15	—
csrf.md	WSTG-SESS-05	—
deserialization.md	WSTG-INPV-11	T1190 Exploit Public-Facing Application
dom-clobbering.md	—	—
http-request-smuggling.md	WSTG-INPV-15	T1190 Exploit Public-Facing Application
http-verb-tampering.md	WSTG-CONF-06	—
idor.md	WSTG-ATHZ-04	—
jwt-attacks.md	WSTG-SESS-10	—
ldap-injection.md	WSTG-INPV-06	—
lfi-rfi.md	WSTG-INPV-11 / WSTG-INPV-12	T1190 Exploit Public-Facing Application
nosqli.md	—	T1190 Exploit Public-Facing Application
oauth-saml.md	WSTG-ATHN-01	T1539 Steal Web Session Cookie
open-redirect.md	WSTG-CLNT-04	—
prototype-pollution.md	—	T1190 Exploit Public-Facing Application
race-conditions.md	—	—
sqli.md	WSTG-INPV-05	T1190 Exploit Public-Facing Application
ssrf.md	WSTG-INPV-19	T1190 Exploit Public-Facing Application
ssti.md	WSTG-INPV-18	T1190 Exploit Public-Facing Application
upload-bypass.md	WSTG-BUSL-08	T1505.003 Web Shell
xss.md	WSTG-INPV-01 / WSTG-INPV-02	T1059.007 JavaScript
xxe.md	WSTG-INPV-07	T1190 Exploit Public-Facing Application

Framework deep-dives

Phase 9j adds a web/frameworks/ subdirectory with Spring Boot Actuator, WordPress, Jenkins, GitLab, Laravel, Django admin cheatsheets.

Sources

• OWASP Web Security Testing Guide v4.2: https://owasp.org/www-project-web-security-testing-guide/v42/
• OWASP Top 10 (2021): https://owasp.org/Top10/
• PortSwigger Web Security Academy: https://portswigger.net/web-security
• OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/
• HackTricks Pentesting Web: https://book.hacktricks.wiki/en/pentesting-web/web-vulnerabilities-methodology.html