labs

User input concatenated into SQL queries lets attackers exfiltrate, modify, or destroy data. Still in the OWASP Top 10 for a reason.

Inject attacker-controlled JavaScript into a page another user views, and run as that user. Reflected, stored, and DOM-based variants.

Trick a user's browser into sending an authenticated request the user never intended. SameSite cookies and CSRF tokens, until they aren't.

Overlay a transparent iframe of a target site on top of a decoy UI and harvest clicks meant for innocent buttons. UI redress, mouse hijack, drag and drop.

Bugs that live entirely in client-side JavaScript. Sources flow into sinks without ever touching the server, and the server-side WAF doesn't see them.

Misconfigured CORS turns the same-origin policy into a write-once permission to leak credentials. Reflected origins, null origin, wildcard pitfalls.

An XML parser that resolves external entities will read local files, hit internal services, or open a remote DTD channel for blind exfiltration.

The application fetches a URL we control. We point it at internal services, cloud metadata, or 169.254.169.254, and it asks them on our behalf.

Front-end and back-end disagree on where one request ends. We hide a second request inside the first, and the back-end serves it to the next victim.

User input concatenated into a shell command. Once you escape the original command, the OS happily runs the rest. RCE the moment you find it.