> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/web-app-hacking.md).

# Web App Hacking

- [Enumeration](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration.md)
- [Webserver Virtualhost Subdomains](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/webserver-virtualhost-subdomains.md)
- [Common Identifiers](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/common-identifiers.md)
- [Web Fuzzing](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/web-fuzzing.md)
- [Directory Enumeration](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/directory-enumeration.md)
- [Automated Directory Enumeration](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/directory-enumeration/automated-directory-enumeration.md)
- [Manual Directory Enumeration](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/directory-enumeration/manual-directory-enumeration.md)
- [Automated Web Technology Detection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/automated-web-technology-detection.md)
- [User Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks.md): These attacks affect a user in a web application
- [CORS Misconfigurations](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/cors-misconfigurations.md)
- [DNS Rebinding](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/dns-rebinding.md)
- [Open Redirect](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/open-redirect.md)
- [Clickjacking](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/clickjacking.md)
- [Cross Site Request Forgery (CSRF)](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/cross-site-request-forgery-csrf.md): Making a request on the user's behalf.
- [Session Fixation](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/session-fixation.md)
- [XSS/Cross Site Scripting](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/xss-cross-site-scripting.md)
- [CSS Injection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/css-injection.md)
- [HTML Injection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/html-injection.md)
- [Phishing](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/phishing.md)
- [Database Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/database-attacks.md)
- [SQL Injection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/database-attacks/sql-injection.md): SQLi / SQL Injection
- [Get a Shell From DB Connection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/database-attacks/get-a-shell-from-db-connection.md): You have a connection to a database. How can you get a shell from that?
- [Server Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks.md)
- [Collisions](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/collisions.md)
- [Server Side Request Forgery](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/server-side-request-forgery.md): SSRF / Server Side Request Forgery
- [Redis SSRF](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/server-side-request-forgery/redis-ssrf.md)
- [Insecure Direct Object Reference](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/insecure-direct-object-reference.md)
- [Timing-Based Side-Channel Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/timing-based-side-channel-attacks.md)
- [Attacking Authentication Methods](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/attacking-authentication-methods.md)
- [JWT Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/attacking-authentication-methods/jwt-attacks.md)
- [Brute Forcing Web Forms](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/attacking-authentication-methods/brute-forcing-web-forms.md): Usually used to attack a login form
- [Loose Comparisons](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/loose-comparisons.md)
- [Unrestricted File Upload](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/page-3.md)
- [Insecure Deserialization](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/page-2.md)
- [Command Injection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/page-1.md)
- [Path Traversal](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/path-traversal.md)
- [File Inclusion](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/file-inclusion.md)
- [Server-Side Template Injection](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/server-side-template-injection.md)
- [XML External Entities Injection (XXE)](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/xml-external-entities-injection-xxe.md)
- [Server Misconfigurations](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/server-misconfigurations.md)
- [Parser Inconsistencies](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/parser-inconsistencies.md)
- [Bypassing WAFs](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/server-attacks/bypassing-wafs.md): Bypass web application firewalls
- [DNS Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/dns-attacks.md)
- [Cloud Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/cloud-attacks.md)
- [Amazon Web Services](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/cloud-attacks/amazon-web-services.md)
- [Interesting Outdated Attacks](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/interesting-outdated-attacks.md)
- [SQL Truncation](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/interesting-outdated-attacks/sql-truncation.md)