Web Pentest

SQL injection with WAF bypasses, XSS in different contexts, SSRF for cloud metadata access, command injection with filter evasion, JWT attacks, GraphQL introspection, IDOR enumeration, and business logic flaws like negative quantities. The advanced section gets into HTTP request smuggling (CL.TE, TE.CL, H2.CL variants) and web cache poisoning techniques that most guides skip. It's comprehensive enough that you won't need to context switch between multiple references during an assessment. The payloads are copy-paste ready but assume you understand what you're doing and have authorization.