Web LLM Attacks

CSRF where token validation depends on token being present - Lab#03

CSRF where token validation depends on request method - Lab#02

CSRF vulnerability with no defenses - Lab#01

What is Cross-site request forgery?

Exploiting insecure output handling in LLMs - Lab#04

Indirect prompt injection - Lab#03

LLM - Indirect prompt injection

Exploiting LLM APIs with excessive agency - Lab#01

Web LLM Attacks

Expert System and Machine Learning

Exploiting server-side parameter pollution in a REST URL - Lab#05

Fuzzing parameter - Lab#04 - Part#02

Exploiting server-side parameter pollution in a query string - Lab#04

Exploiting a mass assignment vulnerability - Lab#03

Finding and exploiting an unused API endpoint - Lab#02

Exploiting an API endpoint using documentation - Lab#01

API Endpoints and Documentation

SOAP vs REST API

What is an Application Programming Interface (API)?

Reflected XSS protected by CSP, with CSP bypass - Lab#30

Reflected XSS in a JavaScript URL with some characters blocked - Lab#28

Reflected XSS with event handlers and href attributes blocked - Lab#27

Reflected XSS with AngularJS sandbox escape and CSP - Lab26

Reflected XSS with AngularJS sandbox escape without strings - Lab#25