WebSecAtlas

A web security knowledge and research repository focused on data flow, parser differentials, trust boundaries, and vulnerability chains rather than payload collection.

See ROADMAP.md for the topic roadmap.

Structure

• fundamentals/: underlying models for HTTP, browsers, authentication, and authorization
• code-audit/: review notes for Python, PHP, JavaScript/TypeScript, Go, and Java
• case-studies/: sanitized CTF, lab, and local reproduction studies
• labs/: minimal vulnerable and remediated experiments
• references/: curated external material without copied third-party content
• templates/: standardized experiment and write-up templates

Entry Points

• TOPICS.md: index of existing topics and cases
• fundamentals/: Web and API knowledge distilled into reusable mechanisms
• case-studies/ctf/: recent CTF Web write-ups
• case-studies/labs/: complete lab attack chains and failure analysis
• research/: cross-domain themes that can develop into research questions

Core Themes

1. HTTP, URLs, proxies, caches, and parser differentials across components
2. Authentication, object-level authorization, business state machines, and race conditions
3. The browser same-origin model, CSP, CORS, XSS, XS-Leaks, and admin bots
4. APIs, GraphQL, WebSockets, and modern framework boundaries
5. Files, templates, serialization, SSRF, command execution, and combined exploit chains
6. Source-to-sink code data flow and post-remediation regression testing

Inclusion Standard

Every case should answer the following questions: What input is controllable? Which components and trust boundaries does it cross? What is the root cause? What are the minimal reproduction and failure conditions? How can the behavior be observed, remediated, and verified?

All material is limited to CTFs, local labs, and explicitly authorized environments.

Repository Scope

• This repository stores knowledge models, experiments, source-code reviews, case studies, and research questions.
• A case becomes evidence of capability only when it can be reproduced, explained, remediated, and regression-tested.
• Work that develops its own codebase, experimental matrix, and release cadence should become a separate repository; WebSecAtlas should retain only its index and research summary.