Web Security Index

Purpose

This index is the root entry point for the web-security branch of the cybersecurity atlas.

Use it to: - navigate the web-security notes - understand the order of study - connect networking concepts to application-layer vulnerabilities - expand into API security, attack surface mapping, and playbooks

Use Reference Registry — Web Security as the source of truth for references in this branch. Return to Cybersecurity Index for root navigation across branches.

Before this branch: - Foundations (Phase 0). - TCP/IP basics, HTTP overview, HTTP headers, Cookies and sessions, TLS/HTTPS.

Recommended learning order

Phase 1 — Core mental models

1. owasp-top-10
2. broken-access-control
3. idor
4. auth-flaws
5. mfa-phishing-resistance
6. session-management

Phase 2 — Input and client-side attacks

7. sql-injection
8. xss
9. csrf
10. path-traversal
11. command-injection
12. xxe

Phase 3 — Server-side and proxy-aware attacks

13. ssrf
14. request-smuggling
15. evilginx-and-reverse-proxy-phishing
16. business-logic-vulnerabilities
17. open-redirect
18. oauth-security

Phase 4 — Supporting context

19. cors-misconfiguration
20. file-upload-abuse
21. deserialization
22. content-security-policy
23. clickjacking
24. bot-detection-signals

Core web-security cluster

Foundations

• owasp-top-10
• broken-access-control
• idor
• auth-flaws
• mfa-phishing-resistance
• session-management

Input and client-side exploitation

• sql-injection
• xss
• csrf
• path-traversal
• command-injection
• xxe
• open-redirect

Server-side exploitation

• ssrf
• request-smuggling
• evilginx-and-reverse-proxy-phishing
• business-logic-vulnerabilities
• file-upload-abuse
• deserialization
• gadget-chains
• phar-deserialization
• oauth-security

Browser and policy behavior

• cors-misconfiguration
• content-security-policy
• clickjacking
• bot-detection-signals

Cross-links to networking

• http-overview → request/response model for all web exploits
• http-messages → raw shape of requests, headers, bodies
• http-headers → cookies, CSP, CORS, forwarding, caching
• cookies-and-sessions → state and session behavior
• reverse-proxies → trust boundaries and request parsing
• client-ip-trust → header-based trust abuse
• tls-https → transport and cookie security
• metadata-endpoints → SSRF impact amplification

Suggested future notes

Next atomic notes

• secure-headers
• html-injection
• http-trace-method
• hidden-parameters
• bug-bounty-reporting

Connected playbooks

• exploit-idor
• exploit-sqli
• investigate-ssrf
• inspect-session-handling
• reverse-proxy-misconfig-checklist
• test-cors-behavior

References

• Foundational: OWASP Top 10 — https://owasp.org/www-project-top-ten/
• Foundational: OWASP WSTG Latest — https://owasp.org/www-project-web-security-testing-guide/latest/
• Testing / Lab: PortSwigger Web Security Academy — https://portswigger.net/web-security