# INJECTIONS

- [CLIENT-SIDE](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side.md)
- [CROSS-SITE SCRIPTING (XSS)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss.md)
- [XSS DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-discovery.md)
- [XSS TESTING (MANUAL)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-discovery/xss-testing-manual.md)
- [XSS TESTING (HYBRID)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-discovery/xss-testing-hybrid.md)
- [WEBPAGE DEFACEMENT](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/webpage-defacement.md)
- [XSS PHISHING](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-phishing.md)
- [XSS SESSION HIJACKING (AKA COOKIE STEALING)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-session-hijacking-aka-cookie-stealing.md)
- [BASIC XSS TESTS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-session-hijacking-aka-cookie-stealing/basic-xss-tests.md)
- [OBTAINING SESSION COOKIES (PHP SERVER)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-session-hijacking-aka-cookie-stealing/obtaining-session-cookies-php-server.md)
- [OBTAINING SESSION COOKIES (NETCAT SERVER)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-scripting-xss/xss-session-hijacking-aka-cookie-stealing/obtaining-session-cookies-netcat-server.md)
- [SQL INJECTION (SQLI)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli.md)
- [01.SQLI DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery.md)
- [01.SQLI TESTING (MANUAL)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/01.sqli-testing-manual.md)
- [URL PARAMETER METHOD](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/01.sqli-testing-manual/url-parameter-method.md)
- [LOGIN FORMS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/01.sqli-testing-manual/login-forms.md)
- [01.SQLI TESTING (HYBRID)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/01.sqli-testing-hybrid.md)
- [SQLMAP](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/01.sqli-testing-hybrid/sqlmap.md)
- [02.SQLI LOCATION IDENTIFICATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/01.sqli-discovery/02.sqli-location-identification.md)
- [02.SQLI DB ENUMERATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/02.sqli-db-enumeration.md)
- [AUTHENTICATION BYPASS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/authentication-bypass.md)
- [CREDENTIAL DUMPING](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/credential-dumping.md)
- [SQLI READING FILES](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/sqli-reading-files.md)
- [SQLI WRITING WEB SHELL FILES](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/sql-injection-sqli/sqli-writing-web-shell-files.md)
- [COMMAND INJECTION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection.md)
- [01.DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/01.discovery.md)
- [FILTER EVASION/BYPASS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass.md)
- [FRONT-END VALIDATION: CUSTOMIZED HTTP REQUEST](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/front-end-validation-customized-http-request.md)
- [SPACE & NEW LINE CHARACTERS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/space-and-new-line-characters.md)
- [SLASH & BACKSLASH](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/slash-and-backslash.md)
- [BLACKLISTED CHARACTERS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/blacklisted-characters.md)
- [BLACKLISTED CMDS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/blacklisted-cmds.md)
- [ADVANCED CMD OBFUSCATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/filter-evasion-bypass/advanced-cmd-obfuscation.md)
- [EVASION TOOLS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/command-injection/evasion-tools.md)
- [HTML INJECTION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/html-injection.md)
- [XML EXTERNAL EXTITY (XXE)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe.md)
- [DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/discovery.md)
- [WINDOWS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/discovery/windows.md)
- [INFORMATION DISCLOSURE](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/information-disclosure.md)
- [INFORMATION TAMPERING](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/information-tampering.md)
- [RCE](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/information-tampering/rce.md)
- [EXFILTRATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/exfiltration.md)
- [OOB BLIND DATA EXFIL](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/exfiltration/oob-blind-data-exfil.md)
- [XXEINJECTOR (AUTOMATED)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/exfiltration/oob-blind-data-exfil/xxeinjector-automated.md)
- [IMPACT](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/impact.md)
- [DOS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/xml-external-extity-xxe/impact/dos.md)
- [CROSS-SITE REQUEST FORGERY (CSRF/XSRF)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf.md)
- [DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/discovery.md)
- [CSRF BYPASS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/csrf-bypass.md)
- [TRIGGERS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers.md)
- [W/O ANTI-CSRF TOKEN](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/w-o-anti-csrf-token.md)
- [WITH ANTI-CSRF TOKEN (GET METHOD)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/with-anti-csrf-token-get-method.md)
- [WITH ANTI-CSRF TOKEN (POST METHOD)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/with-anti-csrf-token-post-method.md)
- [CHAINING (XSS & CSRF)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/chaining-xss-and-csrf.md)
- [MAKING PROFILE PUBLIC](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/chaining-xss-and-csrf/making-profile-public.md)
- [ADDING A FUNCTION TO THE PROFILE PAGE](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/chaining-xss-and-csrf/adding-a-function-to-the-profile-page.md)
- [WEAK CSRF TOKENS](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/client-side/cross-site-request-forgery-csrf-xsrf/triggers/weak-csrf-tokens.md)
- [SERVER-SIDE](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side.md)
- [SSRF](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssrf.md)
- [01.DISCOVERY](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssrf/01.discovery.md)
- [BLIND SSRF](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssrf/01.discovery/blind-ssrf.md)
- [ENUMERATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssrf/enumeration.md)
- [LFI](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssrf/lfi.md)
- [SSTI](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti.md)
- [IDENTIFICATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti/identification.md)
- [JINJA (EXPLOITATION)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti/jinja-exploitation.md)
- [TWIG (EXPLOITATION)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti/twig-exploitation.md)
- [HANDLEBARS NODEJS (EXPLOITATION)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti/handlebars-nodejs-exploitation.md)
- [PAYLOAD](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssti/handlebars-nodejs-exploitation/payload.md)
- [SSI INJECTION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssi-injection.md)
- [SSI (EXPLOITATION)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/ssi-injection/ssi-exploitation.md)
- [XSLT INJECTION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/xslt-injection.md)
- [IDENTIFICATION](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/xslt-injection/identification.md)
- [XSLT INJECTION (EXPLOITATION)](/playbook/oco/02.engagement/01.in/02.initial-access-foothold/exploitation/type/injections/server-side/xslt-injection/xslt-injection-exploitation.md)
