Pentest Notes

Web Exploitation

Common web attack patterns, fuzzing, and testing checklists.

Search Notes Browse Tags

Category Index

Jump by topic or browse the full notebook tree below.

SQLMap Csrf Sql Injection Databases Xxe Xml Fuzzing Cors Xss

Topic Map

Structured like a notebook: categories, subtopics, and individual notes.

SQLMap

Notes on SQLMap.

In Cookie Notes and commands for In Cookie.
In GET Parameters Notes and commands for In GET Parameters.
Simple Commands Notes and commands for Simple Commands.

Csrf

Notes on Csrf.

CSRF Token Notes on CSRF Token.
Defense Notes and commands for Defense.
Ref. XSS Notes and commands for Ref. XSS.
Samesite Cookies Notes on Samesite Cookies.
CSRF Token
- Removing Notes and commands for Removing.
- Request forgery Notes and commands for Request forgery.
- Token tied to cookie CSRF token tied to a cookie (not necessarily the session cookie).
- Token==Cookie Notes and commands for Token==Cookie.
- u_token != session_token CSRF token is not bound to the session token.
Samesite Cookies
- 2min_rule Notes and commands for 2min_rule.
- Strict Gadgets Notes and commands for Strict Gadgets.
- Using GET Notes and commands for Using GET.

Sql Injection Databases

Notes on Sql Injection Databases.

File Injection Notes and commands for File Injection.
Fingerprinting Notes and commands for Fingerprinting.
General SQL Notes and commands for General SQL.
Injection Notes and commands for Injection.
Prevention Notes and commands for Prevention.
SQL in PHP Notes and commands for SQL in PHP.
Unions Notes and commands for Unions.

Xxe Xml

Notes on Xxe Xml.

Blind Injection Notes and commands for blind Injection.
Defense Notes and commands for Defense.
Tools Notes and commands for Tools.

Fuzzing

Notes on Fuzzing.

Dir Fuzzing Notes and commands for Dir Fuzzing.

Cors

Notes on Cors.

Basic (CORS: True) Notes and commands for Basic (CORS: True).
CORS: NULL Notes and commands for CORS: NULL.
CORS: Subdomains Notes and commands for CORS: Subdomains.
CORS: TLS Break Notes and commands for CORS: TLS Break.

Xss

Notes on Xss.

Basic Payloads Notes and commands for Basic Payloads.
Bind-XSS-Cookie Stealing Notes and commands for Bind-XSS-Cookie Stealing.
Defacing Notes and commands for Defacing.
Phishing Notes and commands for Phishing.
Prevention Notes and commands for Prevention.
Tools Notes and commands for Tools.