> For the complete documentation index, see [llms.txt](https://appsecexplained.gitbook.io/appsecexplained/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://appsecexplained.gitbook.io/appsecexplained/common-vulns.md).

# Common vulns

- [SQL injection overview](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview.md)
- [Detection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/detection.md)
- [Blind SQLi](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/blind-sqli.md)
- [Second-order SQLi](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/second-order-sqli.md)
- [SQLi lab setup & writeups](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/sqli-lab-setup-and-writeups.md)
- [NoSQL injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/nosql-injection.md)
- [JavaScript injection (XSS)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/javascript-injection-xss.md)
- [XSS Methodology](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/javascript-injection-xss/xss-methodology.md)
- [File Inclusion](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion.md)
- [Local file inclusion](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion/local-file-inclusion.md)
- [Directory traversal](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion/local-file-inclusion/directory-traversal.md)
- [Command injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/command-injection.md)
- [XXE (XML external entity) injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection.md)
- [Blind XXE](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection/blind-xxe.md)
- [Template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection.md)
- [Server-side template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection/server-side-template-injection.md)
- [Client-side template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection/client-side-template-injection.md)
- [Authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication.md)
- [Attacking password-based authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/attacking-password-based-authentication.md)
- [Attacking MFA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/attacking-mfa.md)
- [Authentication lab setup & writeups](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/authentication-lab-setup-and-writeups.md)
- [Cross-Site Request Forgery (CSRF)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/cross-site-request-forgery-csrf.md)
- [Insecure deserialization](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization.md)
- [PHP](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/php.md)
- [Java](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/java.md)
- [Python](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/python.md)
- [.NET](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/.net.md)
- [Server-side request forgery (SSRF)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/server-side-request-forgery-ssrf.md)
- [Insecure file upload](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-file-upload.md)
- [Clickjacking](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/clickjacking.md)
- [Open redirect](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/open-redirect.md)
- [Vulnerable components](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/vulnerable-components.md)
- [Race conditions](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/race-conditions.md)
- [Limit overrun](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/race-conditions/limit-overrun.md)
- [Prototype pollution](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/prototype-pollution.md)
- [Client-side prototype pollution](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/prototype-pollution/client-side-prototype-pollution.md)
- [APIs](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis.md)
- [API: BOLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-bola.md)
- [API: Broken authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-broken-authentication.md)
- [BOPLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/bopla.md)
- [API: BFLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-bfla.md)