Web Application Penetration Testing

  1. Advanced Attack Techniques
    1. HTTP Request Smuggling
      1. CL.TE Vulnerabilities
        1. TE.CL Vulnerabilities
          1. TE.TE Vulnerabilities
            1. Detection Techniques
              1. Exploitation Methods
                1. Prevention and Mitigation
                2. HTTP/2 Specific Attacks
                  1. HTTP/2 Request Smuggling
                    1. Stream Multiplexing Abuse
                      1. Header Compression Attacks
                        1. Server Push Vulnerabilities
                        2. WebSocket Security Testing
                          1. WebSocket Handshake Analysis
                            1. Message Manipulation
                              1. Cross-Site WebSocket Hijacking
                                1. Authentication and Authorization
                                  1. Input Validation Testing
                                  2. Server-Side Includes Injection
                                    1. SSI Syntax and Commands
                                      1. File Inclusion via SSI
                                        1. Remote Code Execution
                                          1. Detection and Exploitation
                                          2. Expression Language Injection
                                            1. EL Syntax Analysis
                                              1. Framework-Specific EL Injection
                                                1. Remote Code Execution
                                                  1. Prevention Techniques
                                                  2. Prototype Pollution
                                                    1. JavaScript Prototype Chain
                                                      1. Pollution Vectors
                                                        1. Client-Side Exploitation
                                                          1. Server-Side Exploitation
                                                          2. Deserialization Attacks
                                                            1. Java Deserialization Gadgets
                                                              1. .NET Deserialization Chains
                                                                1. Python Pickle Exploitation
                                                                  1. PHP Object Injection
                                                                  2. Cache Poisoning Attacks
                                                                    1. Web Cache Deception
                                                                      1. HTTP Cache Poisoning
                                                                        1. CDN Cache Manipulation
                                                                          1. Browser Cache Poisoning

                                                                        Previous

                                                                        10. Web Services and API Security Testing

                                                                        Go to top

                                                                        Next

                                                                        12. Reporting and Remediation