Interactive breakdowns of vulnerability classes: step by step you see how the attack works and how to close it
The server hands back an object by the id in your request without checking that it is yours
OpenInput is spliced straight into the SQL query text and rewrites its logic
OpenInstead of a string the server accepts an operator object and lets it replace the match condition
OpenAttacker HTML is stored on the page and runs in the victim's browser
OpenThe server itself fetches any URL you hand it - even into the internal network
OpenA filename with ../ traversal reads outside the allowed directory
OpenInput lands inside a system command, and you append your own to it
OpenInput is dropped into the template and runs as a template-engine expression
OpenA __proto__ key in an object merge corrupts the prototype of every object
OpenThe server copies every body field into the model - including ones you were never meant to touch
OpenWeak signature verification lets you forge the claims inside the token
OpenThe XML parser resolves external entities and reads files off the server
OpenThe server reflects any Origin and allows cookies - so a foreign site reads your data
OpenThe server reconstructs an object from untrusted data and executes attacker logic
OpenThe __schema introspection query exposes the entire hidden structure of the API
OpenSeveral requests in the window between check and write slip past the limit
OpenWith no attempt limit, a short code falls to plain brute force
OpenAn unkeyed header is reflected into the response and poisons the shared cache
OpenA private page under a static-looking URL gets cached as if it were public
OpenAn unvalidated redirect_uri sends the authorization code to the attacker
OpenA WebSocket with no Origin check opens the private stream to a foreign site
OpenThe proxy and the server split the stream differently - the leftover tail hijacks another user's request
Open