My notes about web pentesting
Categories:
- Information gathering
- IIS tilde enumeration
- Fuzzing using GoBuster
- JavaScript deobfuscation
- XSS
- SQL injection
- SQLMap
- Command injection
- File upload attacks
- Server side attacks (SSRF, SSI, SSTI, XSLT injection)
- Login brute force
- Broken authentication
- HTTP verb tampering
- IDOR
- XML External Entity Injection
- File inclusion
- Session security
- Web services and API attacks (REST, SOAP, GraphQL)
- WordPress hacking
- LDAP security
- Insecure deserialization
- Mass assignment vulnerabilities