🌐Web Applications
Injection
Broken Authentication
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging & Monitoring
Web Applications Vulnerabilities
Attacking Web Applications
URL Encoding
Injection Operator
Injection Character
URL-Encoded Character
Executed Command
Semicolon
;
%3b
Both
New Line
%0a
Both
Background
&
%26
Both (second output generally shown first)
Pipe
|
%7c
Both (only second output is shown)
AND
&&
%26%26
Both (only if first succeeds)
OR
||
%7c%7c
Second (only if first fails)
Sub-Shell
``
%60%60
Both (Linux-only)
Sub-Shell
$()
%24%28%29
Both (Linux-only)
Tab
%09
Using tabs instead of spaces
$IFS
${IFS}
Will be replaced with a space and a tab. Cannot be used in sub-shells (i.e. $())
Bash Brace Expansion
{}
Example: 127.0.0.1%0a{ls,-la} Commas will be replaced with spaces
Burp Repeater
To URL-encode text, select that text and right-click on it
Select (Convert Selection>URL>URL encode key characters), or by selecting the text and clicking [CTRL+U]
Front End Vulnerabilities
Cross-Site Scripting (XSS)
DOM XSS Javascript
Last updated