WebApp Security Ultra Harness (Comprehensive)

SYS_DATE: 2026-10-09 00:00 | SIZE: 636 words
#Web #Security #Checklist #AI-Harness #RedTeam #BugBounty

🌐 WebApp Security Ultra Harness

🤖 AI Harness Instructions:
This file is optimized for LLM ingestion. You can prompt:

  1. “Analyze my unchecked items in Category 1. Generate a 7-day deep-dive study plan with specific PortSwigger labs and GitHub tools to master them.”
  2. “Summarize the 2025/2026 academic papers linked under ‘RAG Poisoning’ and ‘WebAssembly’ into a threat model.”
  3. “Give me 5 real HackerOne writeups from the ‘SSRF’ section and extract the exact bypass techniques used.”

💉 1. Injection & Code Execution

  • SQL Injection Attack (SQLi)

  • Hibernate Query Language (HQL) Injection

  • Direct OS Code Injection (Command Injection)

  • XML Entity Injection (XXE)

  • LDAP Injection

  • XPath Injection

  • Server-Side Includes (SSI) / Template Injection (SSTI)

  • SMTP Injection / Email Header Injection

  • Direct Dynamic Code Evaluation (‘Eval Injection’)

  • Function Injection / PHPwn (PHP Object Injection)

  • Remote Code Execution (RCE) Attacks

🎭 2. Cross-Site Scripting (XSS) & Client-Side

  • Cross-Site Scripting (XSS) - General / Stored / Reflected

  • XSSing Client-Side Dynamic HTML (DOM XSS)

  • Reflected DOM Injection

  • Mutation XSS (mXSS) & Universal XSS (uXSS)

  • Blended Threats and JavaScript / Blind XSS

🖱️ 3. UI Redressing & Clickjacking

  • Click Jacking Attacks / UI Redressing

  • Next Generation Click Jacking / Tap Jacking / Stroke Jacking

  • Turning XSS into Clickjacking / Bypassing CSRF with ClickJacking

🔑 4. Authentication, Session & Identity

  • Broken Authentication and Session Management

  • Session fixation / hijacking / Prediction / Bruteforce of PHPSESSID

  • Credential stuffing / Brute force attack

  • CAPTCHA Re-Riding Attack

🚪 5. Access Control & Authorization

  • Insecure Direct Object References (IDOR) / BOLA

  • Missing Function Level Access Control (BFLA)

  • Forced browsing / Cross-User Defacement

🔄 6. CSRF, CORS & State Manipulation

  • Cross-Site Request Forgery (CSRF) / XSRF

  • Exploitation of CORS

  • HTTP Parameter Pollution (HPP) / Parameter Delimiter

📁 7. Server-Side & File Inclusion

  • Server-Side Request Forgery (SSRF)

  • Remote File inclusion (RFI) / Local file inclusion (LFI) / Path Traversal

  • Arbitrary file access / Binary planting / Symlinking

🌐 8. HTTP, Network & Protocol Attacks

  • HTTP Response Splitting / Smuggling / Verb Tampering

  • Host Header injection

  • DNS Cache Poisoning / NAT Pinning / DNS Rebinding

  • Cross Site Port Attack (XSPA) / Cross-Site Port Attacks

  • URL Hijacking / Typosquatting

🔐 9. Cryptography, TLS & Side-Channel

  • Sensitive Data Exposure / Cookie Poisoning / EverCookie

  • Side Channel Attacks in SSL / Improving HTTPS Side Channel Attacks

  • Attacking HTTPS with Cache Injection / Web Cache Deception

🧠 10. Browser Mechanics, History & Storage

  • Cross Site History Manipulation (XSHM) / Tabnabbing

  • Persistent Cross Interface Attacks / Generic Cross-Domain theft

💥 11. Denial of Service & Resource Exhaustion

  • Denial of Service (DoS) / Traffic flood

  • Regular expression Denial of Service – ReDoS

⚙️ 12. Configuration, Supply Chain & Infrastructure

  • Security Misconfiguration

  • Using Components with Known Vulnerabilities

🕵️ 13. Advanced, Niche & Legacy Attacks

  • Execution After Redirect (EAR) / Unvalidated Redirects and Forwards

  • Fooling B64_Encode(Payload) on WAFs And Filters

  • Lost iN Translation (i18n/l10n attacks) / Content Spoofing

  • Man-in-the-browser / Man-in-the-middle / Quick Proxy Detection

  • SQLi Filter Evasion Cheat Sheet (MySQL) / Stacked Queries

  • Chronofeit Phishing / One-Click Attack / Form action hijacking

  • Parameter Pollution (Marked Complete)

🚀 14. NEW: 2025/2026 Modern Web & AI Classes

Cutting-edge vectors not covered in legacy lists.

  • AI / LLM Prompt Injection (Direct & Indirect)

  • RAG (Retrieval-Augmented Generation) Poisoning

  • WebAssembly (Wasm) Exploitation & Memory Corruption

  • GraphQL & API Security (BFLA/BOLA/Introspection)

  • Supply Chain / CI/CD Pipeline Poisoning

  • Passkeys / WebAuthn Bypasses & Biometric Spoofing

  • Post-Quantum Cryptography Migration Flaws

  • HTTP/3 & QUIC Vulnerabilities

  • OAuth 2.1 / OIDC Flaws & Token Manipulation

  • WebRTC Leaks & Real-Time Communication Attacks

💡 Pro Tip for AI Harnessing:
Copy this entire file and paste it into an LLM with the prompt:
“I am studying for my web security certification. Look at the unchecked items in Category 14 (Modern Classes). Generate a 4-week study plan with specific PortSwigger labs, GitHub tools to install, and 2 real-world HackerOne reports to read for each week.”