# Common Web Application Attacks

> Directory traversal, file inclusion, command injection, and cross-site scripting. Detection, exploitation, and filter bypass techniques for the most common web vulnerabilities.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 3
- **Published:** 2026-09-23
- **Updated:** 2026-09-25

This module covers the most frequently encountered web vulnerabilities in penetration testing. Directory traversal and file inclusion give you file reads and sometimes code execution. Command injection turns user input into shell commands. Cross-site scripting steals sessions and credentials from other users. Each attack class has detection, exploitation, and bypass techniques.

## Directory Traversal and File Inclusion

Path traversal reads files outside the web root. Local file inclusion executes server-side code from those files, and remote file inclusion loads attacker-hosted payloads. File upload vulnerabilities bypass restrictions to plant web shells. These are high-value findings that often lead directly to code execution.

## Command Injection

When user input reaches a system command, injection operators like `;`, `|`, and `$()` give you shell access. Detection ranges from in-band output to blind time-based and out-of-band techniques. Filters are common but bypassable with encoding, variable substitution, and alternative operators.

## Cross-Site Scripting (XSS)

XSS executes JavaScript in another user's browser. Reflected XSS requires a crafted link, stored XSS fires on every page load, and DOM-based XSS never reaches the server. The impact ranges from cookie theft to full account takeover. Filter bypasses and encoding tricks are essential for real-world exploitation.

## Study material

- [Directory Traversal Detection](https://hackindex.io/services/web/vulnerability-discovery/directory-traversal-detection.md) (read, core)
- [Directory Traversal](https://hackindex.io/services/web/exploitation/directory-traversal.md) (read, core)
- [HTTP File Inclusion Fuzzing](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion/file-inclusion-fuzzing.md) (read, core)
- [Local File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/local-file-inclusion-exploitation.md) (read, core)
- [Remote File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/remote-file-inclusion-exploitation.md) (read, core)
- [LFI to Remote Code Execution](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution.md) (read, core)
- [File Upload Validation Testing](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion/file-upload-testing.md) (read, core)
- [File Upload Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/file-upload-exploitation.md) (read, core)
- [Command Injection Detection](https://hackindex.io/services/web/vulnerability-discovery/command-injection-detection.md) (read, core)
- [Command Injection Exploitation](https://hackindex.io/services/web/exploitation/command-injection.md) (read, core)
- [Command Injection Bypasses](https://hackindex.io/services/web/exploitation/file-inclusion/command-injection-bypasses.md) (read, core)
- [Reflected XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/reflected-xss-checks.md) (read, core)
- [Reflected XSS Exploitation](https://hackindex.io/services/web/exploitation/reflected-xss-exploitation.md) (read, core)
- [Stored XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/stored-xss-checks.md) (read, core)
- [Stored XSS Exploitation](https://hackindex.io/services/web/exploitation/stored-xss-exploitation.md) (read, core)
- [DOM-Based XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/dom-based-xss-checks.md) (read, core)
- [DOM-Based XSS Exploitation](https://hackindex.io/services/web/exploitation/dom-based-xss-exploitation.md) (read, core)
- [XSS Filter Bypass](https://hackindex.io/services/web/exploitation/xss-filter-bypass.md) (read, core)
- [JavaScript for XSS](https://hackindex.io/services/web/exploitation/javascript-for-xss.md) (read, core)