> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Vulnerabilities Methodology

> A comprehensive checklist for web penetration testing covering proxies, user input vectors, HTTP headers, authentication bypasses, structured objects, file operations, and more.

In every web pentest there are **several hidden and obvious places that might be vulnerable**. This page is a checklist to confirm you have searched for vulnerabilities in all possible places.

## Proxies

<Note>
  Modern web applications often use intermediary proxies. These vulnerabilities require a vulnerable proxy to be in place, but they usually also need an extra vulnerability in the backend.
</Note>

Proxy-related attack surface:

* Abusing hop-by-hop headers
* Cache Poisoning / Cache Deception
* HTTP Connection Contamination
* HTTP Request Smuggling
* HTTP Response Smuggling / Desync
* H2C Smuggling
* Server Side Inclusion / Edge Side Inclusion
* XSLT Server Side Injection
* Proxy / WAF Protections Bypass

## User Input

<Info>
  Most web applications allow users to input data that will be processed later. Depending on the structure of the data the server expects, some vulnerabilities may or may not apply.
</Info>

### Reflected Values

If introduced data may be reflected in the response, the page might be vulnerable to several issues:

<CardGroup cols={2}>
  <Card title="Client Side Path Traversal" icon="route">
    Exploiting path manipulation on the client side.
  </Card>

  <Card title="Command Injection" icon="terminal">
    Injecting OS commands via user-controlled input.
  </Card>

  <Card title="File Inclusion / Path Traversal" icon="folder-open">
    Including local or remote files through path manipulation.
  </Card>

  <Card title="Open Redirect" icon="arrow-up-right-from-square">
    Redirecting users to attacker-controlled URLs.
  </Card>

  <Card title="Server Side Request Forgery" icon="server">
    Forcing the server to make requests to internal resources.
  </Card>

  <Card title="Server Side Template Injection" icon="code">
    Injecting template expressions into server-side template engines.
  </Card>

  <Card title="XSS" icon="bug">
    Executing arbitrary JavaScript in victims' browsers.
  </Card>

  <Card title="CRLF Injection" icon="text">
    Injecting carriage return/line feed into HTTP headers.
  </Card>
</CardGroup>

### Search Functionalities

If the functionality searches data inside the backend, you may be able to abuse it to search arbitrary data:

* File Inclusion / Path Traversal
* NoSQL Injection
* LDAP Injection
* ReDoS (Regular Expression Denial of Service)
* SQL Injection
* ORM Injection
* XPATH Injection

### Forms, WebSockets, and PostMessages

When a WebSocket posts a message or a form allows users to perform actions, vulnerabilities may arise:

* Cross Site Request Forgery (CSRF)
* Cross-site WebSocket hijacking (CSWSH)
* Phone Number Injections
* PostMessage Vulnerabilities

<Warning>
  **WebSocket Hijacking + Localhost Abuse:** WebSocket upgrades automatically forward cookies and do not block `ws://127.0.0.1`, so any web origin can drive desktop IPC endpoints that skip Origin validation. Observe emitted frames, bruteforce the listening port, then chain a `create → privileged action` pair.

  If you can pass arbitrary JVM flags (such as `AdditionalJavaArguments`), force an error with `-XX:MaxMetaspaceSize=<tiny>` and attach `-XX:OnOutOfMemoryError="<cmd>"` to run OS commands.
</Warning>

### HTTP Headers

Depending on HTTP headers given by the web server, some vulnerabilities might be present:

* Clickjacking
* Iframe Traps / Click Isolation
* Content Security Policy bypass
* Cookies Hacking
* CORS Misconfigurations

### Authentication Bypasses

* 2FA/OTP Bypass
* Bypass Payment Process
* Captcha Bypass
* Account Takeover Playbooks
* Login Bypass
* Race Condition
* Rate Limit Bypass
* Reset Forgotten Password Bypass
* Registration Vulnerabilities

### Structured Objects & Specific Functionalities

Some functionalities require data in a very specific format (like serialized objects or XML):

* Deserialization
* Email Header Injection
* JWT Vulnerabilities
* JSON / XML / YAML Hacking
* XML External Entity (XXE)
* GraphQL Attacks
* gRPC-Web Attacks

### Files

Functionalities that allow uploading files might be vulnerable to several issues:

* File Upload
* Formula Injection (CSV, LaTeX, etc.)
* PDF Injection
* Server Side XSS

### External Identity Management

* OAUTH to Account Takeover
* SAML Attacks

### Other Helpful Vulnerabilities

* Domain / Subdomain Takeover
* IDOR (Insecure Direct Object Reference)
* Mass Assignment (CWE-915)
* Parameter Pollution
* Unicode Normalization Vulnerability

## Web Servers & Middleware

Misconfigurations in the edge stack often unlock more impactful bugs in the application layer:

<AccordionGroup>
  <Accordion title="Web Servers">
    * Apache
    * Nginx
    * IIS (Internet Information Services)
    * Tomcat
    * Werkzeug Debug Exposure
    * PUT Method / WebDAV
    * Special HTTP Headers
    * WSGI Deployment
  </Accordion>

  <Accordion title="Application Frameworks">
    * Django
    * Flask
    * NodeJS / Express
    * Angular
    * Vue / Nuxt
    * Next.js
    * Laravel
    * Symfony
    * Spring Actuators
  </Accordion>

  <Accordion title="CMS & Managed Platforms">
    * WordPress
    * Joomla
    * Drupal
    * Moodle
    * Prestashop
    * Atlassian Jira
    * Grafana
    * Rocket.Chat
    * Zabbix
    * Microsoft SharePoint
    * Sitecore
  </Accordion>

  <Accordion title="APIs, Buckets & Integrations">
    * Web API Pentesting
    * Storage Buckets & Firebase
    * Imagemagick Security
    * Artifactory & Package Registries
  </Accordion>
</AccordionGroup>

## Supply Chain & Identifier Abuse

Attacks targeting build pipelines or predictable identifiers can become initial footholds:

* Dependency Confusion
* Timing Attacks
* UUID Insecurities

## Web3, Extensions & Tooling

Modern applications extend into browsers, wallets, and automation pipelines:

* dApps / Decentralized Applications
* Browser Extension Pentesting
* wfuzz Web Fuzzing