Courses
1. Introduction to Blockchain and Solana
2. Setting Up Your Development Environment
3. Solana Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Solana Programs
6. Building Your First Solana Program
7. Deploying Programs on the Solana Network
8. Interacting with Solana Programs
9. Using Solana CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Solana Programs
13. Optimizing Performance on Solana
14. Exploring Solana Ecosystem Tools
1. Introduction to Blockchain and Ethereum
2. Setting Up Your Development Environment
3. Ethereum Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts
6. Building Your First Smart Contract
7. Deploying Smart Contracts on the Ethereum Network
8. Interacting with Smart Contracts
9. Using Ethereum CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Smart Contracts
13. Optimizing Performance on Ethereum
14. Exploring Ethereum Ecosystem Tools
1. Introduction to Blockchain and Polygon
2. Setting Up Your Development Environment
3. Polygon Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts on Polygon
6. Building Your First Smart Contract on Polygon
7. Deploying Smart Contracts on the Polygon Network
8. Interacting with Smart Contracts on Polygon
9. Using Polygon CLI and SDKs
10. Developing Decentralized Applications (DApps) on Polygon
11. Smart Contract Security Best Practices for Polygon
12. Testing and Debugging Smart Contracts on Polygon
13. Optimizing Performance on Polygon
14. Exploring Polygon Ecosystem Tools
1. JavaScript Prototype Pollution
2. Advanced Server-Side Request Forgery (SSRF)
3. Web Security Tools and Methodologies
4. Source Code Analysis
5. Persistent Cross-Site Scripting
6. Session Hijacking
7. .NET Deserialization
8. Remote Code Execution
9. Blind SQL Injection
10. Data Exfiltration
11. Bypassing File Upload Restrictions and File Extension Filters
12. PHP Type Juggling with Loose Comparisons
13. PostgreSQL Extension and User-Defined Functions
14. Bypassing REGEX Restrictions
15. Magic Hashes
16. Bypassing Character Restrictions
17. UDF Reverse Shells
18. PostgreSQL Large Objects
19. DOM-Based Cross-Site Scripting (Black Box)
20. Server-Side Template Injection
21. Weak Random Token Generation
22. XML External Entity Injection
23. RCE via Database Functions
24. OS Command Injection via WebSockets (Black Box)
Common Web Application Attacks
OSCP · Chapter 6
Common Web Application Attacks
This chapter is a tour of the most common web application attack classes you will encounter repeatedly: injection, broken access control, and insecure configuration. Recognizing the pattern quickly is more valuable than memorizing any single payload.
Key concepts
- Injection: untrusted input reaches an interpreter (SQL, OS shell, LDAP) without separation between code and data.
- Broken access control: the server trusts a client-supplied identifier (user ID, object ID) without re-checking permission on the server side (IDOR).
- Security misconfiguration: default credentials, verbose error/debug pages, and directory listing left enabled in production.
- Most real breaches chain several small issues together — an information leak plus a weak access control check is often enough for full compromise.
Try it yourself
On a vulnerable lab app (DVWA, Juice Shop), find one example each of an injection flaw and a broken access control flaw, and write one sentence explaining the trust boundary that failed in each.