Security Resources
- Secure Code Explain
- SQL Injection
- Reflected Cross-Site-Scripting (XSS)
- Stored Cross-Site-Scripting (XSS)
- DOM Cross-Site-Scripting (XSS)
- XXE Injection
- Clickjacking
- Remote File Inclusion (RFI)
- Remote Code Execution (RCE)
- Insecure direct object references (IDOR)
- Local File Inclusion
- Secure Cookie not set
- HttpOnly Flag not set
- Log Injection
- Cross-Site Request Forgery (CSRF)
- Hardcoded Credentials
- HSTS not Implemented
- Missing Content-Security-Policy Header
- Session Fixation
- Weak Password Policy
- Open Redirection
- Insufficient Account Lockout Policy
- Server-Side Request Forgery (SSRF)
- Cross-origin resource sharing (CORS) Misconfiguration
- Application-level Denial of Service (DoS)
- Java Deserialization
- Unrestricted File Upload
- Host Header Injection
- Server-side template injection (SSTI)
- Insecure Password Storage
- Insecure Password Reset - Token Exposed in Response
- NoSQL Injection
- LDAP Injection
- XPath Injection
- HTTP Response Header Injection (CRLF)
- Mass Assignment
- Race Condition (TOCTOU)
- Broken Function Level Authorization
- JWT Authentication Bypass
- Insecure Randomness in Security Tokens
- Use of Weak Cryptographic Algorithms
- Disabled TLS Certificate Validation
- Prototype Pollution
- Regular Expression Denial of Service (ReDoS)
- Zip Slip (Insecure Archive Extraction)
- Insecure Deserialization in Python (Pickle)
- Verbose Error Messages and Stack Trace Disclosure
- Missing Rate Limiting on APIs
- Sensitive Data Stored in Browser Storage
- GraphQL Introspection and Query Depth Abuse
- Missing Session Expiry and Logout Invalidation
- LLM01: Prompt Injection
- LLM02: Sensitive Information Disclosure
- LLM03: Supply Chain Vulnerabilities in AI Systems
- LLM04: Data and Model Poisoning
- LLM05: Improper Output Handling
- LLM06: Excessive Agency in AI Agents
- LLM07: System Prompt Leakage
- LLM08: Vector and Embedding Weaknesses
- LLM09: Misinformation and Overreliance
- LLM10: Unbounded Consumption
- Security Resources
- HTTP Security Headers
- Input Sanitization Techniques for Secure Coding
- Wordlists
- Out-of-Band Exfiltration Tools
- Browser Extensions
- Search Engines for Hackers
- Vulnerability Explain
- Cross-Site-Scripting (XSS)
- SQL Injection
- Server-Side Request Forgery (SSRF)
- Insecure Direct Object References (IDOR)
- XML External Entity (XXE) Injection
- Remote Code Execution (RCE) and Command Injection
- Local File Inclusion (LFI) and Path Traversal
- Insecure Deserialization
- Open Redirection
- Authentication and JWT Bypass
- Server-Side Template Injection (SSTI)
- Remote File Inclusion (RFI)
- NoSQL Injection
- LDAP and XPath Injection
- CRLF Injection and HTTP Response Splitting
- Host Header Injection
- HTTP Request Smuggling
- Broken Access Control
- Session Fixation
- Clickjacking
- CORS Misconfiguration
- Unrestricted File Upload
- Security Misconfiguration
- Sensitive Data Exposure and Insecure Cryptographic Storage
- Business Logic and Race Condition Vulnerabilities
- GraphQL Security
- API Security and Mass Assignment
- Subdomain Takeover
- Prototype Pollution
- Web Cache Poisoning
- Vulnerable and Outdated Components
- Application-level Denial of Service (DoS)
- Penetration Testing Tricks
- Captcha Bypass
- Graphql [Inprogress]
- 2FA Bypass
- Subdomain Enumeration Tools
- One-Liners for Bug Bounty
- AI, LLM, MCP and Agent Security
- AI Security Testing Methodology
- LLM Threat Modeling and Attack Surface Mapping
- Prompt Injection and Jailbreak Testing
- Indirect Prompt Injection and RAG Security Testing
- LLM Data Leakage, Model Extraction and Tenant Isolation
- Insecure LLM Output Handling
- AI Agent Security Testing
- Agent Memory Poisoning, Multi-Agent and Loop Attacks
- MCP Security Testing Guide
- MCP Tool Poisoning, Shadowing and Rug Pull Attacks
- MCP Server Hardening and Supply Chain Security
- AI Security Testing Tools
- Security Roadmap
- FREE - Security Courses/Resources
GUIDES · REFERENCES · SECURITY NOTES
Security Resources
Browse practical cybersecurity documentation organized by topic.