# Security Notes

## 0x\_xnum

- [Whoami](https://ahmed-tarek.gitbook.io/security-notes/whoami.md)
- [Notes](https://ahmed-tarek.gitbook.io/security-notes/notes.md)
- [Qiuch Recon Methodology](https://ahmed-tarek.gitbook.io/security-notes/notes/qiuch-recon-methodology.md)
- [Enumeration](https://ahmed-tarek.gitbook.io/security-notes/notes/enumeration.md)
- [Active Directory Pentesting](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting.md)
- [Active Directory Components](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/active-directory-components.md)
- [Initial Attack Vectors](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors.md)
- [LLMNR Poisoning](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/llmnr-poisoning.md)
- [SMB Relay Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/smb-relay-attacks.md)
- [IPv6 Attacks ( IPv6 DNS Takeover )](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/ipv6-attacks-ipv6-dns-takeover.md)
- [Printer Hacking](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/printer-hacking.md): Passback Attacks
- [Methodology](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/methodology.md): for the moment
- [Some Other Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/some-other-attacks.md)
- [Zerologon (CVE-2020-1472)](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/some-other-attacks/zerologon-cve-2020-1472.md)
- [PrintNightmare (CVE-2021-1675)](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/initial-attack-vectors/some-other-attacks/printnightmare-cve-2021-1675.md)
- [Post-Compromise Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks.md)
- [Pass Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/pass-attacks.md)
- [Kerberoasting Attack](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/kerberoasting-attack.md)
- [Token Impersonation Attack](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/token-impersonation-attack.md)
- [LNK File Attack](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/lnk-file-attack.md)
- [GPP / cPassword Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/gpp-cpassword-attacks.md)
- [Mimikatz](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/mimikatz.md)
- [Methodology](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/post-compromise-attacks/methodology.md)
- [We've Compromised the Domain](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/weve-compromised-the-domain.md)
- [Dumping the NTDS.dit](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/weve-compromised-the-domain/dumping-the-ntds.dit.md)
- [Golden Ticket Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/weve-compromised-the-domain/golden-ticket-attacks.md)
- [Methodology](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/weve-compromised-the-domain/methodology.md)
- [Case Study](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/case-study.md)
- [Password Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/active-directory-pentesting/password-attacks.md)
- [API-Pen](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen.md)
- [API Discovry](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-discovry.md)
- [Reverse Engineering API Documentation](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/reverse-engineering-api-documentation.md)
- [Excessive Data Exposure](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/excessive-data-exposure.md)
- [Vulnerability Scanning](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/vulnerability-scanning.md)
- [API Authentication Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authentication-attacks.md)
- [Classic Authentication Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authentication-attacks/classic-authentication-attacks.md)
- [API Token Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authentication-attacks/api-token-attacks.md)
- [API Authorization Attacks](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authorization-attacks.md)
- [Broken Object Level Authorization (BOLA)](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authorization-attacks/broken-object-level-authorization-bola.md): BOLA is all about accessing resources that do not belong to you
- [Broken Function Level Authorization](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/api-authorization-attacks/broken-function-level-authorization.md): Where BOLA is all about accessing resources that do not belong to you, BFLA is all about performing unauthorized actions
- [Improper Assets Management](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/improper-assets-management.md)
- [Mass Assignment](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/mass-assignment.md)
- [SSRF](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/ssrf.md)
- [Injection Attacks in API](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/injection-attacks-in-api.md)
- [Evasive Maneuvers](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/evasive-maneuvers.md)
- [GraphQL Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/notes/api-pen/graphql-vulnerabilities.md)
- [Attack Vectors by Port](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port.md): A chill guide to what you can do with each open port
- [FTP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/ftp.md)
- [SSH](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/ssh.md)
- [Telnet](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/telnet.md)
- [SMTP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/smtp.md)
- [DNS](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/dns.md)
- [Kerberos](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/kerberos.md)
- [POP3](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/pop3.md)
- [NTP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/ntp.md)
- [NetBIOS](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/netbios.md)
- [SMB](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/smb.md)
- [MSRPC](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/msrpc.md)
- [SNMP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/snmp.md)
- [LDAP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/ldap.md)
- [Modbus](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/modbus.md)
- [Ms-SQL](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/ms-sql.md)
- [Oracle Listener](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/oracle-listener.md)
- [NFS](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/nfs.md)
- [MySql](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/mysql.md)
- [RDP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/rdp.md)
- [ADB Android Debug Bridge](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/adb-android-debug-bridge.md)
- [WinRM](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/winrm.md)
- [VNC](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/vnc.md)
- [Redis](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/redis.md)
- [IRC](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/irc.md)
- [Tomcat 8080](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/tomcat-8080.md)
- [MongoDB 27017](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/mongodb-27017.md)
- [http](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/http.md)
- [Docker](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/docker.md)
- [Elasticsearch](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/elasticsearch.md)
- [etcd](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/etcd.md)
- [Grafana](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/grafana.md)
- [IMAP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/imap.md)
- [ISCSI](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/iscsi.md)
- [Jenkins](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/jenkins.md)
- [Kafka](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/kafka.md)
- [Kibana](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/kibana.md)
- [LPD](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/lpd.md)
- [Memcached](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/memcached.md)
- [PostgreSQL](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/postgresql.md)
- [RabbitMQ](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/rabbitmq.md)
- [rpcbind](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/rpcbind.md)
- [Rsync](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/rsync.md)
- [RTSP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/rtsp.md)
- [Splunkd](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/splunkd.md)
- [TACACS](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/tacacs.md)
- [TFTP](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/tftp.md)
- [WebDAV](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/webdav.md)
- [WHOIS](https://ahmed-tarek.gitbook.io/security-notes/notes/attack-vectors-by-port/whois.md)
- [Portswigger Labs](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs.md)
- [XSS](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/xss.md)
- [DOM XSS](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/dom-xss.md)
- [SQL Injection](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/sql-injection.md)
- [Access Control](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/access-control.md)
- [Authentication Bypass](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/authentication-bypass.md)
- [Business Logic](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/business-logic.md)
- [Information Disclosure](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/information-disclosure.md)
- [File Upload Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/file-upload-vulnerabilities.md)
- [Deserialization](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/deserialization.md)
- [Prototype Pollution](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/prototype-pollution.md)
- [API Testing](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/api-testing.md)
- [SSTI](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/ssti.md)
- [JSON Web Tokens  ( JWT )](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/json-web-tokens-jwt.md)
- [SSRF](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/ssrf.md)
- [CSRF](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/csrf.md)
- [Cross-Origin Resource Sharing](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/cross-origin-resource-sharing.md)
- [Command Injection](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/command-injection.md)
- [XXE](https://ahmed-tarek.gitbook.io/security-notes/portswigger-labs/xxe.md)
- [A10 Mishandling of Exceptional Conditions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions.md)
- [Sensitive Data in Error Messages and Debug Code](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/sensitive-data-in-error-messages-and-debug-code.md): CWE-209, CWE-215, CWE-550, CWE-756
- [Uncaught Exceptions and Improper Recovery](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/uncaught-exceptions-and-improper-recovery.md): CWE-248, CWE-252, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-703, CWE-754, CWE-755
- [Fail-Open Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/fail-open-vulnerabilities.md)
- [A09 Security Logging and Alerting Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a09-security-logging-and-alerting-failures.md)
- [Logging Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a09-security-logging-and-alerting-failures/logging-vulnerabilities.md): CWE-117, CWE-221, CWE-223, CWE-532, CWE-778
- [A08 Software or Data Integrity Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures.md)
- [Dependencies and Malicious Code Inclusion](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/dependencies-and-malicious-code-inclusion.md)
- [Embedded Malware and Dynamic Modification](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/embedded-malware-and-dynamic-modification.md)
- [Insecure deserialization](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/insecure-deserialization.md)
- [DLL Hijacking](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/dll-hijacking.md)
- [A07 Authentication Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures.md)
- [JWT Hacking](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/jwt-hacking.md)
- [Hardcoded & Default Credentials](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/hardcoded-and-default-credentials.md): CWE-258, CWE-259, CWE-259, CWE-798, CWE-1392, CWE-1393
- [Authentication Bypass](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/authentication-bypass.md): CWE-288, CWE-289, CWE-290, CWE-302, CWE-305
- [Certificate Validation Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/certificate-validation-failures.md): CWE-295, CWE-297, CWE-298, CWE-299, CWE-346:
- [Session Security](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/session-security.md): CWE-384,  CWE-613, CWE-620, CWE-304, CWE-306
- [Dictionary Attacks and Recovery Exploits](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/dictionary-attacks-and-recovery-exploits.md): CWE-307, CWE-521, CWE-640, CWE-1391, CWE-294
- [Network-Based Authentication Flaws](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/network-based-authentication-flaws.md): CWE-291, CWE-293, CWE-300, CWE-350, CWE-940, CWE-941
- [A06 Insecure Design](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design.md)
- [Race Conditions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/race-conditions.md)
- [HTTP Request Smuggling](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/http-request-smuggling.md)
- [UI Attacks](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/ui-attacks.md)
- [Insecure File Upload and Path Traversal](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/insecure-file-upload-and-path-traversal.md): CWE-73, CWE-434, CWE-646
- [Sensitive Data Storage: Encryption, Caching, and Cookies](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/sensitive-data-storage-encryption-caching-and-cookies.md): CWE-256, CWE-311, CWE-312, CWE-313, CWE-316, CWE-522, CWE-525, CWE-539, CWE-598
- [Privilege Escalation and Trust Boundaries](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/privilege-escalation-and-trust-boundaries.md): CWE-266, CWE-269, CWE-286, CWE-501, CWE-602
- [A05 Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection.md)
- [Cross Site Scripting](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting.md)
- [Cross Site Scripting](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/cross-site-scripting.md)
- [Exploitation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/exploitation.md)
- [Protections](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/protections.md)
- [SQL Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/sql-injection.md)
- [SQLmap](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/sql-injection/sqlmap.md)
- [NoSQL Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/nosql-injection.md)
- [CRLF Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/crlf-injection.md)
- [CST Injection ( CSTI )](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cst-injection-csti.md)
- [Command Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/command-injection.md)
- [A04 Cryptographic Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures.md)
- [Weak Algorithms and Inadequate Hashing](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/weak-algorithms-and-inadequate-hashing.md): CWE-327, CWE-326, CWE-328, CWE-759, CWE-760, CWE-916,CWE-780
- [PRNG Failures and Predictable Secrets](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/prng-failures-and-predictable-secrets.md): CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-1241
- [Cryptographic Failure](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/cryptographic-failure.md): this lab covers a lot of basic cwes like CWE-327, CWE-759, CWE-916, CWE-319, CWE-523
- [Weak Encoding for Password](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/weak-encoding-for-password.md): CWE-261
- [Improper Following of a Certificate's Chain of Trust](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust.md)
- [Understanding Digital Certificates :  Self-Signed and CA-Signed Certificate \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust/understanding-digital-certificates-self-signed-and-ca-signed-certificate.md): extra knowledge
- [Transport Layer Security (TLS) and SSL \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust/transport-layer-security-tls-and-ssl.md): extra knowledge
- [Clear Text Transmission Of Sensitive Data](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/clear-text-transmission-of-sensitive-data.md)
- [SSLStripping \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/clear-text-transmission-of-sensitive-data/sslstripping.md): extra knowledge
- [Cryptographic Key Management and Implementation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/cryptographic-key-management-and-implementation.md): CWE-321, CWE-322, CWE-323, CWE-324, CWE-523, CWE-325, CWE-347, CWE-757, CWE-1240
- [A03 Software Supply Chain Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures.md)
- [Use of Obsolete Function](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures/use-of-obsolete-function.md)
- [Vulnerable and Outdated Components](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures/vulnerable-and-outdated-components.md): senarios cover : CWE-1035, CWE-1329, CWE-1357, CWE-1104, CWE-1395
- [A02 Security Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration.md)
- [Cookie Security](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/cookie-security.md)
- [XML External Entity](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/xml-external-entity.md)
- [Improper Model Validation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/improper-model-validation.md)
- [Data Transmission Without Encryption](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/data-transmission-without-encryption.md)
- [CORS Miscofigration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/cors-miscofigration.md)
- [Mail Server Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/mail-server-misconfiguration.md)
- [Debug Binary Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/debug-binary-misconfiguration.md)
- [Exposure of Sensitive Information Through Environment Variables](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/exposure-of-sensitive-information-through-environment-variables.md)
- [A01 Broken Access Control](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control.md)
- [Path Traversal](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/path-traversal.md)
- [Open Redirect](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/open-redirect.md)
- [Symlink or Hard Link Following](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/symlink-or-hard-link-following.md)
- [Confused Deputy](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/confused-deputy.md)
- [Incorrect Default Permissions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/incorrect-default-permissions.md)
- [Forced Browsing](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/forced-browsing.md)
- [Server-Side Request Forgery (SSRF)](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/server-side-request-forgery-ssrf.md)
- [CSRF](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf.md)
- [Sensitive Cookie with Improper SameSite Attribute](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/sensitive-cookie-with-improper-samesite-attribute.md)
- [csrf checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/csrf-checklist.md)
- [checklists](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists.md)
- [ATO](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/ato.md)
- [idor checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/idor-checklist.md)
- [admin panal checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/admin-panal-checklist.md)
- [bussiness logic checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/bussiness-logic-checklist.md)
- [403 bypass](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/403-bypass.md)
- [mass assignment](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/mass-assignment.md)
- [Uploading an Image Was All I Needed for Full Server Access](https://ahmed-tarek.gitbook.io/security-notes/uploading-an-image-was-all-i-needed-for-full-server-access.md)
- [How I Discovered a Dependency Confusion Vulnerability in a Ruby Application Leading to RCE](https://ahmed-tarek.gitbook.io/security-notes/how-i-discovered-a-dependency-confusion-vulnerability-in-a-ruby-application-leading-to-rce.md)
- [Privilege Escalation via Impersonation Features feature](https://ahmed-tarek.gitbook.io/security-notes/privilege-escalation-via-impersonation-features-feature.md)
- [How I Escalated Simple HTML Injection to SSRF via PDF Rendering](https://ahmed-tarek.gitbook.io/security-notes/how-i-escalated-simple-html-injection-to-ssrf-via-pdf-rendering.md)
- [How I was able to discover ATO Via IDOR vulnerability](https://ahmed-tarek.gitbook.io/security-notes/how-i-was-able-to-discover-ato-via-idor-vulnerability.md)
- [how I Bypassed SAML Authentication, and had access to Admin Panel.](https://ahmed-tarek.gitbook.io/security-notes/how-i-bypassed-saml-authentication-and-had-access-to-admin-panel..md)