---
# System prepended metadata

title: Web Sec

---

# Web Sec

+ JWT Attacks
    + Not verifying signatures
    + Accepting without signatures
    + Weak secret
    + Self signed JWK parameters
+ File Uploads
    + Extension bypass
    + User uploadable folder 
    + Configuration file upload
+ Information Disclosure
+ SQL Injection
    + In band
    + Error based
    + Union based
    + Boolean based
    + Time-based
    + Out-of-band
+ Cross-Site Scripting
    + Types: Stored, DOM-based, Reflected
    + Prevention:
        + CSP
        + 

