> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/web.md). # Web - [Prerequisites](https://ret2basic.gitbook.io/ctfnote/web/prerequisites.md) - [OWASP Top 10](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10.md) - [1. Broken Access Control](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/1.-broken-access-control.md) - [2. Cryptographic Failures](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/2.-cryptographic-failures.md) - [3. Injection](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/3.-injection.md) - [4. Insecure Design](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/4.-insecure-design.md) - [5. Security Misconfiguration](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/5.-security-misconfiguration.md) - [6. Vulnerable and Outdated Components](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/6.-vulnerable-and-outdated-components.md) - [7. Identification and Authentication Failures](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/7.-identification-and-authentication-failures.md) - [8. Software and Data Integrity Failures](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/8.-software-and-data-integrity-failures.md) - [9. Security Logging and Monitoring Failures](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/9.-security-logging-and-monitoring-failures.md) - [10. SSRF](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/owasp-top-10/10.-ssrf.md) - [HTTP](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/http.md) - [HTTP Status Codes](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/http/http-status-codes.md) - [HTTP Headers](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/http/http-headers.md) - [Burp Suite](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/burp-suite.md) - [Burp Intruder](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/burp-suite/burp-intruder.md) - [Burp Extender](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/burp-suite/burp-extender.md) - [Burp Collaborator](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/burp-suite/burp-collaborator.md) - [Information Gathering](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/information-gathering.md) - [DNS](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/information-gathering/dns.md) - [Git](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/information-gathering/git.md) - [Editor](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/information-gathering/editor.md) - [Server](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/information-gathering/server.md) - [Bug Bounty Report Writing](https://ret2basic.gitbook.io/ctfnote/web/prerequisites/report-writing.md) - [File Upload](https://ret2basic.gitbook.io/ctfnote/web/file-upload.md) - [Webshell](https://ret2basic.gitbook.io/ctfnote/web/file-upload/webshell.md) - [IIS, Nginx, and Apache Vulnerabilities](https://ret2basic.gitbook.io/ctfnote/web/file-upload/iis-nginx-and-apache-vulnerabilities.md) - [.htaccess (Apache) / web.config (IIS)](https://ret2basic.gitbook.io/ctfnote/web/file-upload/.htaccess-apache-web.config-iis.md) - [Alternate Data Stream](https://ret2basic.gitbook.io/ctfnote/web/file-upload/alternate-data-stream.md) - [Code Review: bWAPP Unrestricted File Upload](https://ret2basic.gitbook.io/ctfnote/web/file-upload/code-review-bwapp-unrestricted-file-upload.md) - [SQL Injection (SQLi)](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli.md) - [Cheat Sheet](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/cheat-sheet.md) - [UNION Attacks](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/union-attacks.md) - [Examining the Database](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/examining-the-database.md) - [Blind SQL Injection](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/blind-sql-injection.md) - [WAF Bypass](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/waf-bypass.md) - [Out-Of-Band (OOB)](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/out-of-band-oob.md) - [Webshell and UDF](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/webshell-and-udf.md) - [sqlmap](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/sqlmap.md) - [Code Review: Initialization](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/sqlmap/code-review-initialization.md) - [Code Review: tamper](https://ret2basic.gitbook.io/ctfnote/web/sql-injection-sqli/sqlmap/code-review-tamper.md) - [Cross-Site Scripting (XSS)](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss.md) - [Cheat Sheet](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/cheat-sheet.md) - [Reflected XSS](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/reflected-xss.md) - [Stored XSS](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/stored-xss.md) - [DOM-Based XSS](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/dom-based-xss.md) - [XSS Contexts](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/xss-contexts.md) - [CSP](https://ret2basic.gitbook.io/ctfnote/web/cross-site-scripting-xss/csp.md) - [CSRF and SSRF](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf.md) - [Client-Side Request Forgery (CSRF)](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/client-side-request-forgery-csrf.md) - [XSS vs. CSRF](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/client-side-request-forgery-csrf/xss-vs.-csrf.md) - [CSRF Tokens and SameSite Cookies](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/client-side-request-forgery-csrf/csrf-tokens-and-samesite-cookies.md) - [Server-Side Request Forgery (SSRF)](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/server-side-request-forgery-ssrf.md) - [Attacks](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/server-side-request-forgery-ssrf/attacks.md) - [Bypassing Restrictions](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/server-side-request-forgery-ssrf/bypassing-restrictions.md) - [SSRF + Redis](https://ret2basic.gitbook.io/ctfnote/web/csrf-and-ssrf/server-side-request-forgery-ssrf/ssrf-+-redis.md) - [XML External Entities (XXE)](https://ret2basic.gitbook.io/ctfnote/web/xml-external-entities-xxe.md) - [Insecure Deserialization](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization.md) - [Python Deserialization](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/python-deserialization.md) - [PHP Deserialization](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/php-deserialization.md) - [Java Deserialization](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/java-deserialization.md) - [Shiro](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/java-deserialization/shiro.md) - [FastJSON](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/java-deserialization/fastjson.md) - [WebLogic](https://ret2basic.gitbook.io/ctfnote/web/insecure-deserialization/java-deserialization/weblogic.md) - [HTTP Request Smuggling](https://ret2basic.gitbook.io/ctfnote/web/http-request-smuggling.md) - [OS Command Injection](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection.md) - [Whitespace Bypass](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/whitespace-bypass.md) - [Blacklist Bypass](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/blacklist-bypass.md) - [Blind OS Command Injection](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/blind-os-command-injection.md) - [Lab 1: HITCON 2015 BabyFirst](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/lab-1-hitcon-2015-babyfirst.md) - [Lab 2: HITCON 2017 BabyFirst Revenge](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/lab-2-hitcon-2017-babyfirst-revenge.md) - [Lab 3: HITCON 2017 BabyFirst Revenge v2](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/lab-3-hitcon-2017-babyfirst-revenge-v2.md) - [Directory Traversal](https://ret2basic.gitbook.io/ctfnote/web/directory-traversal.md) - [HTTP Parameter Pollution](https://ret2basic.gitbook.io/ctfnote/web/http-parameter-pollution.md) - [Server-Side Template Injection (SSTI)](https://ret2basic.gitbook.io/ctfnote/web/server-side-template-injection-ssti.md) - [LDAP Injection](https://ret2basic.gitbook.io/ctfnote/web/ldap-injection.md) - [Redis](https://ret2basic.gitbook.io/ctfnote/web/redis.md) - [Authentication](https://ret2basic.gitbook.io/ctfnote/web/redis/authentication.md) - [RCE](https://ret2basic.gitbook.io/ctfnote/web/redis/rce.md) - [Mitigations](https://ret2basic.gitbook.io/ctfnote/web/redis/mitigations.md)