Web

Web application testing, built around the OWASP Top 10 and the flaws that actually come up on a test.

The ten categories of web risk, and the map for everything else here.

Untrusted input changing a database query. The classic injection flaw.

Input that the browser runs as code. Reflected, stored and DOM-based.

Reaching data and actions that should be off-limits. The #1 web risk.

Weak logins, resets and sessions — and how they get abused.

Making a logged-in user’s browser act without their intent.

Making the server fetch things it shouldn’t. OWASP A10.

The wrong file in the wrong place — classically a web shell.

Input reaching a system shell. SQLi’s cousin, aimed at the OS.

Defaults, verbose errors and doors left open. Often the quickest win.