This is a try to create a comprehensive list of good write-ups and tools for specific vulnerablitiies.
- https://hackerone.com/reports/79552
- https://hackerone.com/reports/66386
- https://hackerone.com/reports/36105
- https://hackerone.com/reports/39181
- https://hackerone.com/reports/66257
- https://hackerone.com/reports/67386
- https://hackerone.com/reports/15492
- https://portswigger.net/blog/server-side-template-injection
- https://speakerdeck.com/owaspmontreal/workshop-server-side-template-injection-ssti
- https://www.lanmaster53.com/2016/03/09/exploring-ssti-flask-jinja2/
- https://www.lanmaster53.com/2016/03/11/exploring-ssti-flask-jinja2-part-2/
- https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
- https://hackerone.com/reports/125980
- http://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html
- https://sethsec.blogspot.com/2015/12/exploiting-server-side-request-forgery.html
- http://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf
- https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF
- http://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/
- https://www.bishopfox.com/blog/2016/02/burp-collaborate-listen-pentester-reviews-latest-burp-suite-addition/
- https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit
- https://gist.github.com/BuffaloWill/fa96693af67e3a3dd3fb
- https://www.netsparker.com/blog/web-security/private-data-stolen-exploiting-css-injection/
- https://portswigger.net/blog/detecting-and-exploiting-path-relative-stylesheet-import-prssi-vulnerabilities#badcss
- https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent