Cheat sheets.

Dense, scan-first reference cards — payloads, commands, and methodology flows pulled out for when you need them mid-engagement, not a story.

cross-site-scripting.sheet9 §

Cross-Site Scripting (XSS)

The five XSS classes, why injection context decides the payload, and the snippets that actually fire — plus the sink list, a detection flow, and a CTF testing checklist.

WebXSSCTF

path-traversal.sheet7 §

Path Traversal / Directory Traversal

Reading files outside the intended root with ../ — the impact targets worth grabbing, every filter-evasion encoding, OS-specific paths, and the read-to-RCE escalations.

WebPath TraversalLFI

sql-injection.sheet5 §

SQL Injection

Detection through exploitation — boolean, time, union, error, and blind extraction, plus login bypass, NoSQL, and a CTF methodology flow. The payloads that actually matter, nothing that doesn't.

WebSQLiCTF