> For the complete documentation index, see [llms.txt](https://0xn3va.gitbook.io/cheat-sheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xn3va.gitbook.io/cheat-sheets/web-application.md).

# Web Application

- [Abusing HTTP hop-by-hop Request Headers](https://0xn3va.gitbook.io/cheat-sheets/web-application/abusing-http-hop-by-hop-request-headers.md)
- [Broken Authentication](https://0xn3va.gitbook.io/cheat-sheets/web-application/broken-authentication.md)
- [Two-Factor Authentication Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/broken-authentication/two-factor-authentication-vulnerabilities.md)
- [Command Injection](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection.md)
- [Argument Injection](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection/argument-injection.md)
- [Content Security Policy](https://0xn3va.gitbook.io/cheat-sheets/web-application/content-security-policy.md)
- [Cookie Security](https://0xn3va.gitbook.io/cheat-sheets/web-application/cookie-security.md)
- [Cookie Bomb](https://0xn3va.gitbook.io/cheat-sheets/web-application/cookie-security/cookie-bomb.md)
- [Cookie Jar Overflow](https://0xn3va.gitbook.io/cheat-sheets/web-application/cookie-security/cookie-jar-overflow.md)
- [Cookie Tossing](https://0xn3va.gitbook.io/cheat-sheets/web-application/cookie-security/cookie-tossing.md)
- [CORS Misconfiguration](https://0xn3va.gitbook.io/cheat-sheets/web-application/cors-misconfiguration.md)
- [File Upload Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/file-upload-vulnerabilities.md)
- [GraphQL Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/graphql-vulnerabilities.md)
- [HTML Injection](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection.md)
- [base](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection/base.md)
- [iframe](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection/iframe.md)
- [link](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection/link.md)
- [meta](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection/meta.md)
- [target attribute](https://0xn3va.gitbook.io/cheat-sheets/web-application/html-injection/target.md)
- [HTTP Header Security](https://0xn3va.gitbook.io/cheat-sheets/web-application/http-headers-security.md)
- [HTTP Request Smuggling](https://0xn3va.gitbook.io/cheat-sheets/web-application/http-request-smuggling.md)
- [Improper Rate Limits](https://0xn3va.gitbook.io/cheat-sheets/web-application/improper-rate-limits.md)
- [JavaScript Prototype Pollution](https://0xn3va.gitbook.io/cheat-sheets/web-application/javascript-prototype-pollution.md)
- [JSON Web Token Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/json-web-token-vulnerabilities.md)
- [OAuth 2.0 Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/oauth-2.0-vulnerabilities.md)
- [OpenID Connect Vulnerabilities](https://0xn3va.gitbook.io/cheat-sheets/web-application/oauth-2.0-vulnerabilities/openid-connect.md)
- [Race Condition](https://0xn3va.gitbook.io/cheat-sheets/web-application/race-condition.md)
- [Server Side Request Forgery](https://0xn3va.gitbook.io/cheat-sheets/web-application/server-side-request-forgery.md)
- [Post Exploitation](https://0xn3va.gitbook.io/cheat-sheets/web-application/server-side-request-forgery/post-exploitation.md)
- [SVG Abuse](https://0xn3va.gitbook.io/cheat-sheets/web-application/svg-abuse.md)
- [Weak Random Generation](https://0xn3va.gitbook.io/cheat-sheets/web-application/weak-random-generation.md)
- [Web Cache Poisoning](https://0xn3va.gitbook.io/cheat-sheets/web-application/web-cache-poisoning.md)