Web Application Penetration Testing

11.

Advanced Attack Techniques

11.1.

HTTP Request Smuggling

11.1.1.

CL.TE Vulnerabilities

11.1.2.

TE.CL Vulnerabilities

11.1.3.

TE.TE Vulnerabilities

11.1.4.

Detection Techniques

11.1.5.

Exploitation Methods

11.1.6.

Prevention and Mitigation

11.2.

HTTP/2 Specific Attacks

11.2.1.

HTTP/2 Request Smuggling

11.2.2.

Stream Multiplexing Abuse

11.2.3.

Header Compression Attacks

11.2.4.

Server Push Vulnerabilities

11.3.

WebSocket Security Testing

11.3.1.

WebSocket Handshake Analysis

11.3.2.

Message Manipulation

11.3.3.

Cross-Site WebSocket Hijacking

11.3.4.

Authentication and Authorization

11.3.5.

Input Validation Testing

11.4.

Server-Side Includes Injection

11.4.1.

SSI Syntax and Commands

11.4.2.

File Inclusion via SSI

11.4.3.

Remote Code Execution

11.4.4.

Detection and Exploitation

11.5.

Expression Language Injection

11.5.1.

EL Syntax Analysis

11.5.2.

Framework-Specific EL Injection

11.5.3.

Remote Code Execution

11.5.4.

Prevention Techniques

11.6.

Prototype Pollution

11.6.1.

JavaScript Prototype Chain

11.6.2.

Pollution Vectors

11.6.3.

Client-Side Exploitation

11.6.4.

Server-Side Exploitation

11.7.

Deserialization Attacks

11.7.1.

Java Deserialization Gadgets

11.7.2.

.NET Deserialization Chains

11.7.3.

Python Pickle Exploitation

11.7.4.

PHP Object Injection

11.8.

Cache Poisoning Attacks

11.8.1.

Web Cache Deception

11.8.2.

HTTP Cache Poisoning

11.8.3.

CDN Cache Manipulation

11.8.4.

Browser Cache Poisoning

Previous

10. Web Services and API Security Testing

Go to top

Next

12. Reporting and Remediation