Web security resources

General resources

• PortSwigger's web appliction hacker's handbook
• ngalongc's bug bounty reference
• great blog with lots of bug bounty writeups

Headers

• Twilio's HTTP headers for the responsible developer
• Everything you need to know about HTTP security headers

HTTP Strict Transport Security (HSTS)

• Testing the HSTS preload process
• Using security features to do bad things

Cross-Origin Request Sharing (CORS)

• Developers don't understand CORS

Cross-Site Scripting (XSS) / Cross-Site Script Inclusion (XSSI)

• Stack Overflow - what is XSSI?
• Cross-site script inclusion: A fameless but widespread web vulnerability class

CSS Injections

• CSS injection primitives
• Stealing data with CSS

Open redirects

• Stack Overflow - URL fragment and 302 redirects
• Login CSRF + open redirect = account take over
• OWASP - unvalidated redirects and forwards cheat sheet
• PayloadsAllTheThings - Open URL redirection
• Authentication bypass on Airbnb via OAuth tokens theft

Cache poisoning / request smuggling

• HTTP desync attacks: request smuggling reborn
• Practical web cache poisoning

Insecure direct object reference (IDOR)

• IDOR (Insecure direct object reference)

Creative injections

• CRLF injection on Twitter or why blacklists fail

URI exploitation

• Abusing of protocols to upload local files, bypass the HTML5 sandbox, and open popups (Edge)

Scanning

• Exposing intranets with reliable browser-based port scanning