Web Security Index Purpose This index is the root entry point for the web-security branch of the cybersecurity vault. Use it to: - navigate the web-security notes - understand the order of study - connect networking concepts to application-layer vulnerabilities - expand into API security, attack surface mapping, and playbooks Use Reference Registry — Web Security as the source of truth for references in this branch. Return to Cybersecurity Index for root navigation across branches. Before this branch: - Foundations (Phase 0). - TCP/IP basics, HTTP overview, HTTP headers, Cookies and sessions, TLS/HTTPS. Recommended learning order Phase 1 — Core mental models owasp-top-10 broken-access-control idor auth-flaws mfa-phishing-resistance session-management Phase 2 — Input and client-side attacks sql-injection xss csrf path-traversal command-injection xxe Phase 3 — Server-side and proxy-aware attacks ssrf request-smuggling evilginx-and-reverse-proxy-phishing business-logic-vulnerabilities open-redirect oauth-security Phase 4 — Supporting context cors-misconfiguration file-upload-abuse deserialization content-security-policy clickjacking bot-detection-signals Core web-security cluster Foundations owasp-top-10 broken-access-control idor auth-flaws mfa-phishing-resistance session-management Input and client-side exploitation sql-injection xss csrf path-traversal command-injection xxe open-redirect Server-side exploitation ssrf request-smuggling evilginx-and-reverse-proxy-phishing business-logic-vulnerabilities file-upload-abuse deserialization gadget-chains phar-deserialization oauth-security Browser and policy behavior cors-misconfiguration content-security-policy clickjacking bot-detection-signals Cross-links to networking http-overview → request/response model for all web exploits http-messages → raw shape of requests, headers, bodies http-headers → cookies, CSP, CORS, forwarding, caching cookies-and-sessions → state and session behavior reverse-proxies → trust boundaries and request parsing client-ip-trust → header-based trust abuse tls-https → transport and cookie security metadata-endpoints → SSRF impact amplification Suggested future notes Next atomic notes secure-headers html-injection http-trace-method hidden-parameters bug-bounty-reporting Connected playbooks exploit-idor exploit-sqli investigate-ssrf inspect-session-handling reverse-proxy-misconfig-checklist test-cors-behavior References Foundational: OWASP Top 10 — https://owasp.org/www-project-top-ten/ Foundational: OWASP WSTG Latest — https://owasp.org/www-project-web-security-testing-guide/latest/ Testing / Lab: PortSwigger Web Security Academy — https://portswigger.net/web-security