> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/web-pentesting/web-vulnerabilities.md).

# Web Vulnerabilities

- [Server-Side](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side.md)
- [NoSQL Injection](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/nosql-injection.md)
- [SQL Injection](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection.md)
- [UNION Attacks](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection/union-attacks.md)
- [Blind Attacks](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection/blind-sqli.md)
- [Boolean Based](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection/blind-sqli/boolean-based.md)
- [Time Based](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection/blind-sqli/time-based.md)
- [Error Based](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/sql-injection/blind-sqli/error-based.md)
- [Insecure Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization.md)
- [.NET Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization/dotnet.md)
- [Python Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization/python.md)
- [PHP Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization/php.md)
- [Java Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization/java.md)
- [Ruby Deserialization](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/deserialization/ruby.md)
- [File Inclusion & Path Traversal](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion.md)
- [LFI to RCE](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce.md)
- [PHP Wrappers](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/php-wrappers.md)
- [Logs Poisoning](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/logs-poisoning.md)
- [/proc](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/proc.md)
- [PHPInfo](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/phpinfo.md)
- [PHP Sessions](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/php-sessions.md)
- [Segmentation Fault](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/lfi2rce/segmentation-fault.md)
- [RFI to RCE](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-inclusion/rfi-to-rce.md)
- [Command Injection](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/command-injection.md)
- [Brute-Force](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/brute-force.md)
- [SSTI (Server-Side Template Injection)](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/ssti.md)
- [Exposed Git Repositories](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/exposed-git-repositories.md): OWASP A3:2017-Sensitive Data Exposure
- [File Upload](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-upload.md)
- [Client-Side](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/client-side.md)
- [XSS (Cross-Site Scripting)](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/client-side/xss-cross-site-scripting.md)
- [CORS (Cross-origin resource sharing)](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/client-side/cors-cross-origin-resource-sharing.md)