# AppSecExplained

## AppSecExplained

- [Index < START HERE](https://appsecexplained.gitbook.io/appsecexplained/index-less-than-start-here.md)
- [My courses](https://appsecexplained.gitbook.io/appsecexplained/index-less-than-start-here/my-courses.md)
- [How to get started from zero](https://appsecexplained.gitbook.io/appsecexplained/index-less-than-start-here/how-to-get-started-from-zero.md)
- [Live Stream Content](https://appsecexplained.gitbook.io/appsecexplained/live-stream-content.md)
- [Resource of the week](https://appsecexplained.gitbook.io/appsecexplained/live-stream-content/resource-of-the-week.md)
- [Methodology](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/methodology.md)
- [Content discovery / recon](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/content-discovery-recon.md)
- [Subdomains](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/content-discovery-recon/subdomains.md)
- [Endpoints](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/content-discovery-recon/endpoints.md)
- [Parameters](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/content-discovery-recon/parameters.md)
- [Spidering](https://appsecexplained.gitbook.io/appsecexplained/discovery-recon/content-discovery-recon/spidering.md)
- [SQL injection overview](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview.md)
- [Detection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/detection.md)
- [Blind SQLi](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/blind-sqli.md)
- [Second-order SQLi](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/second-order-sqli.md)
- [SQLi lab setup & writeups](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/sql-injection-overview/sqli-lab-setup-and-writeups.md)
- [NoSQL injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/nosql-injection.md)
- [JavaScript injection (XSS)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/javascript-injection-xss.md)
- [XSS Methodology](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/javascript-injection-xss/xss-methodology.md)
- [File Inclusion](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion.md)
- [Local file inclusion](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion/local-file-inclusion.md)
- [Directory traversal](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion/local-file-inclusion/directory-traversal.md)
- [Command injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/command-injection.md)
- [XXE (XML external entity) injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection.md)
- [Blind XXE](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/xxe-xml-external-entity-injection/blind-xxe.md)
- [Template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection.md)
- [Server-side template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection/server-side-template-injection.md)
- [Client-side template injection](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/template-injection/client-side-template-injection.md)
- [Authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication.md)
- [Attacking password-based authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/attacking-password-based-authentication.md)
- [Attacking MFA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/attacking-mfa.md)
- [Authentication lab setup & writeups](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/authentication/authentication-lab-setup-and-writeups.md)
- [Cross-Site Request Forgery (CSRF)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/cross-site-request-forgery-csrf.md)
- [Insecure deserialization](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization.md)
- [PHP](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/php.md)
- [Java](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/java.md)
- [Python](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/python.md)
- [.NET](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-deserialization/.net.md)
- [Server-side request forgery (SSRF)](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/server-side-request-forgery-ssrf.md)
- [Insecure file upload](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/insecure-file-upload.md)
- [Clickjacking](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/clickjacking.md)
- [Open redirect](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/open-redirect.md)
- [Vulnerable components](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/vulnerable-components.md)
- [Race conditions](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/race-conditions.md)
- [Limit overrun](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/race-conditions/limit-overrun.md)
- [Prototype pollution](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/prototype-pollution.md)
- [Client-side prototype pollution](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/prototype-pollution/client-side-prototype-pollution.md)
- [APIs](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis.md)
- [API: BOLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-bola.md)
- [API: Broken authentication](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-broken-authentication.md)
- [BOPLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/bopla.md)
- [API: BFLA](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/apis/api-bfla.md)
- [Rate limiting](https://appsecexplained.gitbook.io/appsecexplained/bypassing-controls/rate-limiting.md)
- [WAF Bypasses](https://appsecexplained.gitbook.io/appsecexplained/bypassing-controls/waf-bypasses.md)
- [Docker-compose.yml files](https://appsecexplained.gitbook.io/appsecexplained/scripts/docker-compose.yml-files.md)
- [Wordpress](https://appsecexplained.gitbook.io/appsecexplained/scripts/docker-compose.yml-files/wordpress.md)
- [SQLi testing labs](https://appsecexplained.gitbook.io/appsecexplained/scripts/docker-compose.yml-files/sqli-testing-labs.md)
- [PHP scripts](https://appsecexplained.gitbook.io/appsecexplained/scripts/php-scripts.md)
- [RCE Function Check](https://appsecexplained.gitbook.io/appsecexplained/scripts/php-scripts/rce-function-check.md)
- [Wordlists](https://appsecexplained.gitbook.io/appsecexplained/scripts/wordlists.md)
- [Single characters](https://appsecexplained.gitbook.io/appsecexplained/scripts/wordlists/single-characters.md)
- [SQLi](https://appsecexplained.gitbook.io/appsecexplained/scripts/wordlists/sqli.md)
- [Getting started](https://appsecexplained.gitbook.io/appsecexplained/code-review/getting-started.md)
- [Sinks](https://appsecexplained.gitbook.io/appsecexplained/code-review/sinks.md)