web

Here's some of my notes on web exploitation:

Local File Inclusion

Local file inclusion is a vulnerability where publicly inaccessible files on a server are leaked

Cross Site Request Forgery is a common client side vulnerability that appears in a good number of CTF challenges.

The decoding and transformation of user supplied data into language objects can result in remote code execution.

Parsing and rendering Markdown into HTML can cause XSS vulnerabilities if the output is not sanitized.

Prototype pollution is a vulnerability where an attacker is able to inject properties into the top level JavaScript prototype.

Flask is a popular python based framework. However, flask developers may make some mistakes that result in vulnerabilities.

SQL Injection is a vulnerability where a user can inject SQL commands into a database and execute them