Безпека застосунків
для розробників

Steal a click on a bank approval button.

• Overlay a transparent iframe
• Capture a real approval
• Ship CSP frame-ancestors

Chain a second command onto a server-side tool.

• Tamper a captured request
• Watch server secrets leak
• Ship argument-list execution

Get code execution through an outdated library.

• Exploit a published CVE
• Run commands via a crafted upload
• Bump the version and scan in CI

Move money from a page the victim never trusted.

• Auto-post a cross-site transfer
• See why cookies ride along
• Add per-session tokens and SameSite

Read system files through a download link.

• Escape the intended folder
• Pull /etc/passwd from the server
• Canonicalise, then verify

Trigger XSS the server never sees.

• Hide a payload in the URL hash
• Trace an unsafe innerHTML sink
• Swap to textContent

Pull an employee PII export from an unlinked route.

• Reach an "internal" URL anonymously
• See why obscurity is not access control
• Enforce auth server-side

Change one digit and read another customer.

• Walk an IDOR from both sides
• Enumerate sequential record ids
• Add the missing ownership check

Redirect a password-reset email to a lookalike domain.

• Forge the X-Forwarded-Host header
• Steal the clicked reset token
• Pin a configured base URL

Hide a phishing page behind a real login.

• Abuse the next parameter
• See why the domain looks right
• Allow relative targets only

Pull production secrets from a forgotten debug route.

• Find an env-dumping endpoint
• Read JWT and database secrets
• Fail closed with an allow-list

Lift personal data straight out of a link.

• Spot identifiers in query strings
• Follow the leak into logs and referrers
• Rewrite to opaque tokens

Craft a malicious URL that runs the moment it opens.

• Reflect a payload off a search page
• Understand the victim-clicks-link flow
• Escape at the render boundary

Make the server fetch its own cloud credentials.

• Abuse a link-preview feature
• Reach the metadata endpoint
• Validate outbound destinations

Plant a session id and inherit the victim login.

• Fix a known id on the victim
• Watch login reuse it
• Regenerate on every login

Dump a database through one unguarded lookup form.

• Exploit a tautology payload
• Exfiltrate tables with UNION SELECT
• Ship the parameterized fix

Plant a script in a comment and watch it fire.

• Store a payload in user content
• See it execute for the next visitor
• Escape output at render time

Replay a session token harvested from a referrer log.

• Catch a token in a redirect URL
• Replay it into a live account
• Move it to an HttpOnly cookie

Harvest a verified customer list from a login form.

• Read differing error bodies
• Measure response-time leaks
• Unify errors and timing

Forge a role claim and become an administrator.

• Tamper the session token
• Jump from viewer to admin
• Verify tokens before trusting them

Predict a password-reset token and take the account.

• Sample tokens from the generator
• Recover Math.random() state
• Move to crypto.randomBytes

Read the password file through an XML upload.

• Submit a crafted purchase order
• Resolve an external entity
• Disable entity resolution