> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications.md).

# Web Applications

- [Access Control](https://ttp.parzival.sh/pentesting/web-applications/access-control.md)
- [APIs](https://ttp.parzival.sh/pentesting/web-applications/apis.md)
- [Swagger API](https://ttp.parzival.sh/pentesting/web-applications/apis/swagger-api.md)
- [Authentication](https://ttp.parzival.sh/pentesting/web-applications/authentication.md)
- [Account Takeover](https://ttp.parzival.sh/pentesting/web-applications/authentication/account-takeover.md)
- [Clickjacking](https://ttp.parzival.sh/pentesting/web-applications/clickjacking.md)
- [Cross Origin Resource Sharing (CORS)](https://ttp.parzival.sh/pentesting/web-applications/cross-origin-resource-sharing-cors.md)
- [Cross Site Request Forgery (CSRF)](https://ttp.parzival.sh/pentesting/web-applications/cross-site-request-forgery-csrf.md)
- [Document Object Model (DOM)](https://ttp.parzival.sh/pentesting/web-applications/document-object-model-dom.md)
- [File Upload](https://ttp.parzival.sh/pentesting/web-applications/file-upload.md)
- [Google Dorking](https://ttp.parzival.sh/pentesting/web-applications/google-dorking.md)
- [GraphQL](https://ttp.parzival.sh/pentesting/web-applications/graphql.md)
- [HTTP Request Smuggling](https://ttp.parzival.sh/pentesting/web-applications/http-request-smuggling.md)
- [Information Disclosure](https://ttp.parzival.sh/pentesting/web-applications/information-disclosure.md)
- [Insecure Direct Object Reference (IDOR)](https://ttp.parzival.sh/pentesting/web-applications/insecure-direct-object-reference-idor.md)
- [Injection Vulnerabilities](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities.md)
- [Cross-Site Scripting (XSS)](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting.md)
- [Blind Cross-Site Scripting](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/blind-cross-site-scripting.md)
- [Finding Cross-Site Scripting](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/finding-cross-site-scripting.md)
- [Stealing Cookies](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/stealing-cookies.md)
- [XSS Payloads](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/xss-payloads.md)
- [CSV Injection](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/csv-injection.md)
- [XML External Entity Injection (XXE)](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/external-entity-injection-xxe.md)
- [LDAP Injection](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/ldap-injection.md)
- [NoSQL Injection](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/nosql-injection.md)
- [Server-Side Template Injection](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/server-side-template-injection.md)
- [SQL Injection](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/sql-injection.md)
- [JSON Web Tokens (JWT)](https://ttp.parzival.sh/pentesting/web-applications/json-web-tokens-jwt.md)
- [Local File Inclusion (LFI)](https://ttp.parzival.sh/pentesting/web-applications/local-file-inclusion-lfi.md)
- [OAuth](https://ttp.parzival.sh/pentesting/web-applications/oauth.md)
- [Open Redirection](https://ttp.parzival.sh/pentesting/web-applications/open-redirection.md)
- [Password Reset Poisoning](https://ttp.parzival.sh/pentesting/web-applications/password-reset-poisoning.md)
- [Prototype Pollution](https://ttp.parzival.sh/pentesting/web-applications/prototype-pollution.md)
- [Race Condition](https://ttp.parzival.sh/pentesting/web-applications/race-condition.md)
- [Rate Limit Bypass](https://ttp.parzival.sh/pentesting/web-applications/rate-limit-bypass.md)
- [Remote Code Execution (RCE)](https://ttp.parzival.sh/pentesting/web-applications/remote-code-execution-rce.md)
- [Remote File Inclusion (RFI)](https://ttp.parzival.sh/pentesting/web-applications/remote-file-inclusion-rfi.md)
- [Suspicious Parameters](https://ttp.parzival.sh/pentesting/web-applications/suspicious-parameters.md)
- [Tooling](https://ttp.parzival.sh/pentesting/web-applications/tooling.md)
- [Burp Suite](https://ttp.parzival.sh/pentesting/web-applications/tooling/burp-suite.md): Notes around using and performing testing with Burp Suite
- [Authentication / Proxy Issues](https://ttp.parzival.sh/pentesting/web-applications/tooling/burp-suite/authentication-proxy-issues.md)
- [Intruder Attack Types](https://ttp.parzival.sh/pentesting/web-applications/tooling/burp-suite/intruder_attack_types.md): Brief descriptions of each attack type in Burp Suite Intruder.
- [Match and Replace](https://ttp.parzival.sh/pentesting/web-applications/tooling/burp-suite/match-and-replace.md)
- [Quality of Life](https://ttp.parzival.sh/pentesting/web-applications/tooling/burp-suite/quality-of-life.md)
- [Misc Tooling](https://ttp.parzival.sh/pentesting/web-applications/tooling/misc-tooling.md)
- [WAF Bypasses](https://ttp.parzival.sh/pentesting/web-applications/waf-bypasses.md)
- [WebSockets](https://ttp.parzival.sh/pentesting/web-applications/websockets.md)
- [Web Cache Deception](https://ttp.parzival.sh/pentesting/web-applications/web-cache-deception.md)
- [Web Cache Poisoning](https://ttp.parzival.sh/pentesting/web-applications/web-cache-poisoning.md)