Web application vulnerabilities: how testers find and fix them

Guides to web application and API vulnerabilities: how each one works, how penetration testers prove it with evidence, and how to fix it in your code.

Each guide explains one vulnerability class the way a penetration tester meets it: what it is, how it works, how a tester proves it with evidence instead of a scanner alert, and how to fix it in the languages and frameworks teams use. Examples run against fictional demo apps and are labeled in each guide.

2FA bypass: how it works, how pentesters test it and how to fix it2FA bypass explained: logic flaws such as response tampering and OTP brute force, phishing-class attacks such as MFA fatigue, real CVEs, tests and fixes in 4 stacks.
Blind SQL injection: boolean vs time-based, and how testers prove itBlind SQL injection explained: boolean, time-based and out-of-band types, delay functions per database, how testers prove it without dumping data, and the fix.
Clickjacking: how to test your site and fix it with headersClickjacking explained: how the hidden iframe attack works, a 5-minute test, frame-ancestors and X-Frame-Options config for 8 stacks, and when it is a real finding.
Command injection: how it works, how testers prove it, how to fix itOS command injection explained: how it works, real CVEs, how testers prove it with controls, and safe code for Python, Node.js, Java, PHP, Go and C#.
Content Security Policy (CSP): how it works, how to test it, how to roll it outWhat a Content Security Policy is, the directives that matter, a strict nonce policy, a Report-Only rollout, config for common stacks and a tester's bypass checklist.
CORS misconfiguration: how it is exploited, tested and fixedCORS misconfiguration explained: reflected origins, null, weak origin checks and credentials. How testers prove a cross-origin read, plus safe config for five stacks.
Cross-site scripting (XSS): examples, fixes and a test checklistCross-site scripting explained: the three types, a worked example, an output encoding table, fixes for six stacks, CSP and cookie flags, and a tester's checklist.
DOM XSS (DOM-based cross-site scripting): sources, sinks and fixesDOM XSS (DOM-based cross-site scripting) explained: sources and sinks, a worked example, safe replacements, a Trusted Types policy, CSP limits and how testers prove it.
File upload vulnerabilities: how uploads go wrong, how testers prove it, how to secure themFile upload vulnerabilities explained: bypass classes, impact beyond web shells, safe proof by testers, and secure upload code for Node.js, Python, Java, PHP and Go.
GraphQL security testing: a test plan with queries and fixesA 10-step GraphQL security testing plan: find the endpoint, check introspection, test authorization, batching, depth limits and CSRF, then fix with code.
Host header injection: how it works, how testers prove it, how to fix itHost header injection explained: password reset poisoning, cache poisoning and routing bugs, real CVEs, how testers prove it safely, and fixes for eight stacks.
HTTP request smuggling: how it works, how testers prove it, how to fix itHTTP request smuggling explained: CL.TE, TE.CL, TE.TE, CL.0 and HTTP/2 variants, safe timing probes, real CVEs with dates, and fixes for proxies and app servers.
Insecure deserialization: how it works, how to test it and how to fix itInsecure deserialization explained: serialization vs deserialization, gadget chains, real CVEs, safe testing, and fixes for Java, Python, PHP, C# and Node.js.
JWT vulnerabilities: how attackers forge tokens and how to stop themJWT vulnerabilities explained: alg none, key confusion, weak secrets, kid and jku abuse, missing claim checks. Safe verify code for four stacks and a test list.
Mass assignment: how it works, how to test it and how to fix itMass assignment explained: how one extra JSON field changes a protected property, how testers prove it with a read-back, and vulnerable versus fixed code for 8 stacks.
NoSQL injection: how it works, how testers prove it, how to fix itNoSQL injection explained: MongoDB operator injection, a login demo, Rocket.Chat CVE-2021-22911, other databases, how testers prove it, and fixes for Node.js and Python.
OAuth vulnerabilities: attacks, fixes and a testing checklistOAuth vulnerabilities explained: redirect_uri, state, PKCE, implicit flow, mix-up and consent flaws, with fixes for four stacks, dated cases and a test checklist.
Open redirect vulnerability: examples, CVEs, safe code and test casesWhat an open redirect is, how it chains into OAuth token theft and SSRF, test cases a naive check misses, four real CVEs, and safe redirect code for 7 stacks.
Password reset vulnerabilities: how they work, how to test them and how to fix themPassword reset vulnerabilities explained: 12 flaws from Host header poisoning to weak tokens, how testers prove each one, a Craft CMS case, and fixes for 5 stacks.
Path traversal (directory traversal): how ../ works, how testers prove it, how to fix itPath traversal (directory traversal) explained: how ../ escapes a folder, encodings, Zip Slip, safe proof by testers, and fixes in Python, Node.js, Java, Go and PHP.
Prototype pollution: how it works, how to find it and how to fix it in Node.jsPrototype pollution explained: how one JSON key changes every object, client and server tests, lodash, minimist and protobufjs CVEs with fixed versions, and tested fixes.
Race condition vulnerability: how testers find it and how to fix itA web race condition lets parallel requests beat a check. See limit overrun examples, how testers prove it, and fixes in SQL, Django, Node.js and Laravel.
Server-side request forgery (SSRF): how it works, how testers prove it, how to fix itServer-side request forgery (SSRF) explained: how it works, where it hides, how testers prove it with evidence, and allow-list code for Python, Node.js, Java and Go.
Server-side template injection (SSTI): how it works, how testers detect it, how to fix itServer-side template injection (SSTI) explained: probe table for 10 template engines, SSTI vs XSS, a real CVE, and safe code for Flask, Express, Spring and Rails.
Session fixation: how it works, how to test it and how to fix itSession fixation explained: how an attacker plants a session ID, the test that proves it, and the fix for PHP, Express, Django and Spring, plus SSO and JWT cases.
SQL injection: how it works, how testers prove it, how to fix it in 7 stacksWhat SQL injection is, a safe demo, real cases with CVE IDs, how testers prove it, and parameterized query fixes for Java, Python, Node.js, PHP, C#, Go and Ruby.
Stored XSS: how to find it, prove it and fix itStored XSS (persistent cross-site scripting) explained: a worked example, where it hides, how testers prove it with two sessions, severity by viewer, and fixes per stack.
Subdomain takeover: how it works, how testers prove it, how to fix dangling DNSSubdomain takeover and dangling DNS explained: provider fingerprints, a read-only detection script, real cases, safe proof steps and the order to remove records.
Web cache poisoning: how it works, how testers prove it, how to fix itWeb cache poisoning explained: unkeyed inputs, a two-request example, real CVEs, safe proof steps, and cache-key fixes for nginx, Cloudflare and CloudFront.
XML external entity (XXE) injection: how it works, how testers prove it, how to fix itXML external entity (XXE) injection explained: how it works, hidden attack surface, recent CVEs, safe tests, and parser settings for Java, Python, PHP, .NET and Node.js.

Related guides on the same ground: IDOR testing, CSRF testing, business logic vulnerabilities, rate limiting and credential stuffing and the OWASP Top 10:2025.

Web application vulnerabilities

Judge us by the report