Web and API
11- WebSecCross-site scripting (XSS)
- SQLiSQL injection
- CMDiCommand injection
- LFILocal file inclusion
- SSTIServer-side template injection
- API SecOWASP API Top 10
- SSRF CloudSSRF and cloud metadata
- Broken access controlInsecure direct object references (IDOR)
- Request forgery and CORSCSRF, SameSite and CORS
- Fix the vulnerabilityFix API code, backed by tests
- Web application hardeningHTTP headers, CSP and cookies