// HackTricks · CC BY-NC 4.0
Web Pentesting
171 pages · adapted from upstream with source attribution on every page.
001 Web Pentesting2FA/MFA/OTP Bypass pentesting-web002 Web PentestingAbusing Hop-by-Hop Headers pentesting-web003 Web PentestingAbusing Service Workers xss-cross-site-scripting004 Web PentestingAccount Takeover pentesting-web005 Web PentestingBasic .NET Deserialization (ObjectDataProvider, ExpandedWrapper, and Json.NET) deserialization006 Web PentestingBasic Java Deserialization with ObjectInputStream readObject deserialization007 Web PentestingBig Binary Files Upload in PostgreSQL postgresql-injection008 Web PentestingBlocking the Main Page to Steal a postMessage postmessage-vulnerabilities009 Web PentestingBrowExt - ClickJacking browser-extension-pentesting-methodology010 Web PentestingBrowExt - permissions & hostpermissions browser-extension-pentesting-methodology011 Web PentestingBrowExt - XSS Example browser-extension-pentesting-methodology012 Web PentestingBrowser Extension Pentesting Methodology browser-extension-pentesting-methodology013 Web PentestingBrowser HTTP Request Smuggling http-request-smuggling014 Web PentestingBypass Payment Process pentesting-web015 Web PentestingBypassing SOP with Iframes - 1 postmessage-vulnerabilities016 Web PentestingBypassing SOP with Iframes - 2 postmessage-vulnerabilities017 Web PentestingCache Poisoning and Cache Deception cache-deception018 Web PentestingCache Poisoning to DoS cache-deception019 Web PentestingCache Poisoning via URL discrepancies cache-deception020 Web PentestingCaptcha Bypass pentesting-web021 Web PentestingChrome Cache to XSS xss-cross-site-scripting022 Web PentestingClickjacking pentesting-web023 Web PentestingClient Side Path Traversal pentesting-web024 Web PentestingClient Side Prototype Pollution nodejs-proto-prototype-pollution025 Web PentestingClient Side Template Injection (CSTI) pentesting-web026 Web PentestingCloud SSRF ssrf-server-side-request-forgery027 Web PentestingCommand Injection pentesting-web028 Web PentestingCommonsCollections1 Payload - Java Transformers to Runtime.exec() and Thread.sleep() deserialization029 Web PentestingConnection Pool by Destination Example xs-search030 Web PentestingConnection Pool Examples xs-search031 Web PentestingContent Security Policy (CSP) Bypass content-security-policy-csp-bypass032 Web PentestingCookie Bomb hacking-with-cookies033 Web PentestingCookie Bomb + Onerror XS Leak xs-search034 Web PentestingCookie Jar Overflow hacking-with-cookies035 Web PentestingCookie Tossing hacking-with-cookies036 Web PentestingCookies Hacking hacking-with-cookies037 Web PentestingCORS - Misconfigurations & Bypass pentesting-web038 Web PentestingCRLF (%0D%0A) Injection pentesting-web039 Web PentestingCSP Bypass via 'self', 'unsafe-inline', and Iframes content-security-policy-csp-bypass040 Web PentestingCSRF (Cross Site Request Forgery) pentesting-web041 Web PentestingCSS Injection css-injection042 Web PentestingCSS Injection Code css-injection043 Web PentestingCypher Injection (Neo4j) sql-injection044 Web PentestingDangling Markup - HTML scriptless injection dangling-markup-html-scriptless-injection045 Web PentestingDApps - Decentralized Applications pentesting-web046 Web PentestingDebugging Client-Side JavaScript xss-cross-site-scripting047 Web PentestingDependency Confusion pentesting-web048 Web PentestingDeserialization deserialization049 Web PentestingDom Clobbering xss-cross-site-scripting050 Web PentestingDOM Invader xss-cross-site-scripting051 Web PentestingDOM XSS xss-cross-site-scripting052 Web PentestingDomain/Subdomain takeover pentesting-web053 Web PentestingEL - Expression Language ssti-server-side-template-injection054 Web PentestingEmail Injections pentesting-web055 Web PentestingEvent Loop Blocking + Lazy images xs-search056 Web PentestingExploiting \\VIEWSTATE without knowing the secrets deserialization057 Web PentestingExploiting VIEWSTATE Knowing the Secret deserialization058 Web PentestingExpress Prototype Pollution Gadgets nodejs-proto-prototype-pollution059 Web PentestingFile Inclusion and Path Traversal file-inclusion060 Web PentestingFile Upload file-upload061 Web PentestingForced Extension Load & Preferences MAC Forgery (Windows) browser-extension-pentesting-methodology062 Web PentestingFormula/CSV/Doc/LaTeX/GhostScript Injection pentesting-web063 Web PentestingHTTP Connection Contamination pentesting-web064 Web PentestingHTTP Connection Request Smuggling pentesting-web065 Web PentestingHTTP Request Smuggling / HTTP Desync Attack http-request-smuggling066 Web PentestingHTTP Response Smuggling / Desync pentesting-web067 Web PentestingIDOR (Insecure Direct Object Reference) pentesting-web068 Web PentestingIframe Traps pentesting-web069 Web PentestingIframes in XSS, CSP and SOP xss-cross-site-scripting070 Web PentestingInteger Overflow (Web Applications) xss-cross-site-scripting071 Web PentestingJava DNS Deserialization, GadgetProbe and Java Deserialization Scanner deserialization072 Web PentestingJava JSF ViewState Deserialization deserialization073 Web PentestingJava SignedObject-gated Deserialization and Pre-auth Reachability via Error Paths deserialization074 Web PentestingJavaScript Execution XS Leak xs-search075 Web PentestingJinja2 SSTI ssti-server-side-template-injection076 Web PentestingJNDI - Java Naming and Directory Interface & Log4Shell deserialization077 Web PentestingJS Hoisting xss-cross-site-scripting078 Web PentestingJSON, XML, and YAML Hacking and Issues pentesting-web079 Web PentestingJWT Vulnerabilities (JSON Web Tokens) pentesting-web080 Web PentestingLaravel Livewire Hydration & Synthesizer Abuse deserialization081 Web PentestingLDAP Injection pentesting-web082 Web PentestingLESS Code Injection leading to SSRF & Local File Read css-injection083 Web PentestingLFI to RCE via PHPInfo file-inclusion084 Web PentestingLFI to RCE via Temporary File Uploads file-inclusion085 Web PentestingLFI2RCE Via compress.zlib + PHPSTREAMPREFERSTDIO + Path Disclosure file-inclusion086 Web PentestingLFI2RCE via Eternal waiting file-inclusion087 Web PentestingLFI2RCE via Nginx temp files file-inclusion088 Web PentestingLFI2RCE via PHP Filters file-inclusion089 Web PentestingLFI2RCE via PHPSESSIONUPLOADPROGRESS file-inclusion090 Web PentestingLFI2RCE via Segmentation Fault file-inclusion091 Web PentestingLogin Bypass login-bypass092 Web PentestingMass Assignment (CWE-915) – Privilege Escalation via Unsafe Model Binding pentesting-web093 Web PentestingMisc JS Tricks & Relevant Info xss-cross-site-scripting094 Web PentestingMS Access SQL Injection sql-injection095 Web PentestingMSSQL Injection sql-injection096 Web PentestingMySQL FILE Privilege to Outbound SMB and RCE mysql-injection097 Web PentestingMySQL injection mysql-injection098 Web PentestingNetwork - Privilege Escalation, Port Scanning, and NTLM Challenge-Response Disclosure postgresql-injection099 Web PentestingNode.js - \\proto\\ and Prototype Pollution nodejs-proto-prototype-pollution100 Web PentestingNoSQL injection pentesting-web101 Web PentestingOAuth to Account Takeover pentesting-web102 Web PentestingOpen Redirect pentesting-web103 Web PentestingOracle injection sql-injection104 Web PentestingORM Injection pentesting-web105 Web PentestingParameter Pollution | JSON Injection pentesting-web106 Web PentestingPDF Injection xss-cross-site-scripting107 Web PentestingPDF Upload: XXE and Same-Origin Policy Bypass file-upload108 Web PentestingPentesting gRPC-Web pentesting-web109 Web Pentestingperformance.now example xs-search110 Web Pentestingperformance.now() + Forced Heavy Task xs-search111 Web Pentestingphar:// Deserialization file-inclusion112 Web PentestingPhone Number Injections pentesting-web113 Web PentestingPHP - Deserialization + Autoload Classes deserialization114 Web PentestingPL/pgSQL Password Bruteforce postgresql-injection115 Web PentestingPostgreSQL dblink and loimport Data Exfiltration postgresql-injection116 Web PentestingPostgreSQL injection postgresql-injection117 Web PentestingPostMessage Vulnerabilities postmessage-vulnerabilities118 Web PentestingPrototype Pollution to RCE nodejs-proto-prototype-pollution119 Web PentestingProxy / WAF Protections Bypass pentesting-web120 Web PentestingPython YAML Deserialization deserialization121 Web PentestingRace Condition pentesting-web122 Web PentestingRate Limit Bypass pentesting-web123 Web PentestingRCE with PostgreSQL Extensions postgresql-injection124 Web PentestingRCE with PostgreSQL Languages postgresql-injection125 Web PentestingReflecting Techniques - PoCs and Polygloths CheatSheet pocs-and-polygloths-cheatsheet126 Web PentestingRegistration & Takeover Vulnerabilities pentesting-web127 Web PentestingRegular Expression Denial of Service - ReDoS pentesting-web128 Web PentestingRequest Smuggling in HTTP/2 Downgrades http-request-smuggling129 Web PentestingReset/Forgotten Password Bypass pentesting-web130 Web PentestingReverse Tab Nabbing pentesting-web131 Web PentestingRSQL Injection pentesting-web132 Web PentestingRuby Class Pollution deserialization133 Web PentestingRuby on Rails json pollution deserialization134 Web PentestingSame-Site Leaks (SS-Leaks) dangling-markup-html-scriptless-injection135 Web PentestingSAML Attacks saml-attacks136 Web PentestingSAML Basics saml-attacks137 Web PentestingSecond-Order Injection with sqlmap sqlmap138 Web PentestingServer Side Inclusion/Edge Side Inclusion Injection pentesting-web139 Web PentestingServer Side XSS (Dynamic PDF) xss-cross-site-scripting140 Web PentestingShadow DOM xss-cross-site-scripting141 Web PentestingSniff Leak xss-cross-site-scripting142 Web PentestingSOAP/JAX-WS ThreadLocal Authentication Bypass pentesting-web143 Web PentestingSOME - Same Origin Method Execution xss-cross-site-scripting144 Web PentestingSQL Injection sql-injection145 Web PentestingSQL Login Bypass Payloads login-bypass146 Web PentestingSQLMap sql-injection147 Web PentestingSQLMap - Cheatsheet sqlmap148 Web PentestingSSRF (Server Side Request Forgery) ssrf-server-side-request-forgery149 Web PentestingSSRF Vulnerable Platforms ssrf-server-side-request-forgery150 Web PentestingSSTI (Server Side Template Injection) ssti-server-side-template-injection151 Web PentestingSteal Info JS xss-cross-site-scripting152 Web PentestingStealing postMessage Data by Navigating an Iframe postmessage-vulnerabilities153 Web PentestingTiming Attacks pentesting-web154 Web PentestingUnicode Injection unicode-injection155 Web PentestingUnicode Normalization unicode-injection156 Web PentestingUpgrade Header Smuggling pentesting-web157 Web PentestingURL Format Bypass ssrf-server-side-request-forgery158 Web PentestingURL Max Length - Client Side xs-search159 Web PentestingUUID Insecurities pentesting-web160 Web PentestingWeb Tool - WFuzz pentesting-web161 Web PentestingWeb Vulnerabilities Methodology pentesting-web162 Web PentestingWeb Vulns List pocs-and-polygloths-cheatsheet163 Web PentestingWebAssembly linear memory corruption to DOM XSS (template overwrite) xss-cross-site-scripting164 Web PentestingWebSocket Attacks pentesting-web165 Web PentestingXPATH injection pentesting-web166 Web PentestingXS-Search/XS-Leaks xs-search167 Web PentestingXSLT Server-Side Injection (Extensible Stylesheet Language Transformations) pentesting-web168 Web PentestingXSS (Cross Site Scripting) xss-cross-site-scripting169 Web PentestingXSS in Markdown xss-cross-site-scripting170 Web PentestingXSSI (Cross-Site Script Inclusion) pentesting-web171 Web PentestingXXE - XEE - XML External Entity pentesting-web