Glossary of terms (XSS, CSRF, SSRF, IDOR, XXE, RCE, WAF, SAST, DAST).

Gruyere covers the OWASP Top 10 thoroughly. Here are the critical vulnerabilities you will identify and abuse.

XSS is the "bread and butter" of web vulnerabilities. It occurs when an application includes untrusted data in a web page without proper validation.

State-changing requests Exploit: Attacker tricks a logged-in user into submitting a forged request (e.g., transfer money) without consent.

: By modifying cookies or hidden form fields, attackers can impersonate other users or escalate their privileges to administrator status. Cross-Site Script Inclusion (XSSI)

The codelab organizes challenges by vulnerability type, providing real-world examples of: Google Gruyere Cross-Site Scripting (XSS) : Including reflected, stored, and file upload-based XSS. Cross-Site Request Forgery (XSRF/CSRF)