⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.
Three of the most common web bugs found in testing and CTFs. Hunt them with Burp.
XSS — Cross-Site Scripting
Injecting script that runs in another user's browser.
<script>alert(document.domain)</script>
"><img src=x onerror=alert(1)>| Variant | Where it lives |
|---|---|
| Reflected | Echoed from the request |
| Stored | Saved server-side, hits every viewer |
| DOM | Client-side JS sink (innerHTML) |
Defense: context-aware output encoding, CSP, framework auto-escaping.
SSRF — Server-Side Request Forgery
Make the server fetch a URL you choose — pivot to internal services / cloud metadata:
http://localhost/admin
http://169.254.169.254/latest/meta-data/ # cloud metadata
file:///etc/passwdDefense: allowlist outbound hosts, block link-local/internal ranges, no raw user URLs.
IDOR — Insecure Direct Object Reference
Swap an ID to access someone else's data:
GET /api/invoice/1001 → GET /api/invoice/1002Defense: enforce object-level authorization on every request (test it with Burp's Autorize).
Related: SQL Injection, Web App Penetration Testing Cheat Sheet, Securing a Public PHP App.