> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy.md).

# PortSwigger Academy

- [Server-side topics](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics.md)
- [Authentication vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/authentication-vulnerabilities.md): https://portswigger.net/web-security/authentication
- [OS Command Injection](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/os-command-injection.md): https://portswigger.net/web-security/os-command-injection
- [File Path Traversal](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/file-path-traversal.md): https://portswigger.net/web-security/file-path-traversal
- [Business logic vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/business-logic-vulnerabilities.md): https://portswigger.net/web-security/logic-flaws
- [Information disclosure vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/information-disclosure-vulnerabilities.md): https://portswigger.net/web-security/information-disclosure
- [Access control vulnerabilities and privilege escalation](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/access-control-vulnerabilities-and-privilege-escalation.md): https://portswigger.net/web-security/access-control
- [File upload vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/file-upload-vulnerabilities.md): https://portswigger.net/web-security/file-upload
- [Server-side request forgery (SSRF)](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/server-side-request-forgery-ssrf.md): https://portswigger.net/web-security/ssrf
- [XML external entity (XXE) injection](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/server-side-topics/xml-external-entity-xxe-injection.md): https://portswigger.net/web-security/xxe
- [Client-side topics](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics.md)
- [Cross-site scripting](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/cross-site-scripting.md): https://portswigger.net/web-security/cross-site-scripting
- [Cross-origin resource sharing (CORS)](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/cross-origin-resource-sharing-cors.md): https://portswigger.net/web-security/cors
- [Cross-site request forgery (CSRF)](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/cross-site-request-forgery-csrf.md): https://portswigger.net/web-security/csrf
- [Clickjacking (UI redressing)](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/clickjacking-ui-redressing.md): https://portswigger.net/web-security/clickjacking
- [DOM-based vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/dom-based-vulnerabilities.md): https://portswigger.net/web-security/dom-based
- [Testing for WebSockets security vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/client-side-topics/testing-for-websockets-security-vulnerabilities.md): https://portswigger.net/web-security/websockets
- [Advanced topics](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics.md)
- [Insecure deserialization](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/insecure-deserialization.md): https://portswigger.net/web-security/deserialization
- [Server-side template injection](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/server-side-template-injection.md): https://portswigger.net/web-security/server-side-template-injection
- [Web cache poisoning](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/web-cache-poisoning.md): https://portswigger.net/web-security/web-cache-poisoning
- [HTTP Host header attacks](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/http-host-header-attacks.md): https://portswigger.net/web-security/host-header
- [HTTP request smuggling](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/http-request-smuggling.md): https://portswigger.net/web-security/request-smuggling
- [OAuth 2.0 authentication vulnerabilities](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/oauth-2.0-authentication-vulnerabilities.md): https://portswigger.net/web-security/oauth
- [JWT attacks](https://cel1s0.gitbook.io/offsec-notes/portswigger-academy/advanced-topics/jwt-attacks.md): https://portswigger.net/web-security/jwt