> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec.md).

# WEB-AppSec

- [Web Application Fundamentals](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals.md)
- [Basic of Web Application](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/basic-of-web-application.md)
- [User Input in Application](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/user-input-in-application.md)
- [HTTP Request and Response](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/http-request-and-response.md)
- [HTTP Security Headers](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/http-security-headers.md)
- [Cookies vs Session vs Token](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/cookies-vs-session-vs-token.md)
- [Vulnerable Labs](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/vulnerable-labs.md)
- [Burp Suite](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/burp-suite.md)
- [Top Most Used Extensions](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/burp-suite/top-most-used-extensions.md)
- [TLS Pass Through](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/burp-suite/tls-pass-through.md)
- [Vulnerable Env Setup](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/vulnerable-env-setup.md)
- [Injections](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections.md)
- [SQLi](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli.md)
- [Error Based](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/error-based.md)
- [Blind Based](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/blind-based.md)
- [Time Based](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/blind-based/time-based.md)
- [Boolean Based](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/blind-based/boolean-based.md)
- [Out of band](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/out-of-band.md)
- [Double Query Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/double-query-injection.md)
- [Second Order Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/second-order-injection.md)
- [SQLMap](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/sqlmap.md)
- [Cross-Site Scripting (XSS)](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/cross-site-scripting-xss.md)
- [Reflected XSS](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/cross-site-scripting-xss/reflected-xss.md)
- [Stored XSS](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/cross-site-scripting-xss/stored-xss.md)
- [DOM XSS](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/cross-site-scripting-xss/dom-xss.md)
- [Command Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/command-injection.md)
- [HTML Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/html-injection.md)
- [Code Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/code-injection.md)
- [Server Side Template Injection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/server-side-template-injection.md)
- [File Upload](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/file-upload.md)
- [Local File Inclusion](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/local-file-inclusion.md)
- [Remote File Inclusion](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/remote-file-inclusion.md)
- [LFI, RFI, and RBT File Read](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/lfi-rfi-and-rbt-file-read.md)
- [Cross-Site Request Forgery (CSRF)](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/cross-site-request-forgery-csrf.md)
- [Server-Side Request Forgery (SSRF)](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/server-side-request-forgery-ssrf.md)
- [Authentication Workflow](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/authentication-workflow.md)
- [Login/Sign-In Page](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/authentication-workflow/login-sign-in-page.md)
- [Registration/Sign-Up Page](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/authentication-workflow/registration-sign-up-page.md)
- [Multi-factor Authentication](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/authentication-workflow/multi-factor-authentication.md)
- [OAuth Authentication](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/authentication-workflow/oauth-authentication.md)
- [Broken Access Control](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/broken-access-control.md)
- [Business logic](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/business-logic.md)
- [Open Redirection](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/open-redirection.md)
- [Dependency Confusion](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/dependency-confusion.md)