+ Core Controls +
- Home
- + Login/Register
- Toggle Hints
- Toggle Security
- Setup/Reset the DB
- Show Log
- Credits
- Hide Popup Hints
+
+ OWASP Top 10 +
- + A1 - SQL Injection +
  - + SQLi - Extract Data +
    - User Info
    +
  - + SQLi - Bypass Authentication +
    - Login
    +
  - + SQLi - Insert Injection +
    - Register
    +
  - + Blind SQL via Timing +
    - Login
    - User Info
    +
  - + SQLMAP Practice Target +
    - View Someones Blog
    - User Info
    +
  - + Via JavaScript Object Notation (JSON) +
    - Pen Test Tool Lookup
    - Pen Test Tool Lookup (AJAX)
    +
  +
- + A1 - Other Injection +
  - + HTML Injection (HTMLi) +
    - Add to your blog
    +
  - + HTMLi via HTTP Headers +
    +
  - + HTMLi Via DOM Injection +
    - HTML5 Storage
    +
  - + HTMLi Via Cookie Injection +
    - Capture Data Page
    +
  - + Frame Source Injection +
    - Document Viewer
    +
  - + JavaScript Injection +
    - Those "Back" Buttons
    - + + Password Generator + +
    - Browser Info
    +
  - + HTTP Parameter Pollution +
    - Poll Question
    - Document Viewer
    +
  - + Cascading Style Injection +
    - Set Background Color
    +
  - + JavaScript Object Notation (JSON) Injection +
    - Pen Test Tool Lookup
    - Pen Test Tool Lookup (AJAX)
    +
  - + Buffer Overflow +
    - Repeater
    +
  - + Parameter Addition +
    - Repeater
    +
  +
- + A2 - Cross Site Scripting (XSS) +
  - + Reflected (First Order) +
    - Pen Test Tool Lookup
    - User Info
    - Set Background Color
    - HTML5 Storage
    - Capture Data Page
    - Document Viewer
    +
  - + Persistent (Second Order) +
    - Add to your blog
    - View someone's blog
    - Show Log
    - +
    +
  - + DOM Injection +
    - HTML5 Storage
    +
  - + Via "Input" (GET/POST) +
    - Add to your blog
    - View someone's blog
    - Show Log
    - +
    - User Info
    - Missing HTTPOnly Attribute
    - Set Background Color
    - Pen Test Tool Lookup
    +
  - + Via HTTP Headers +
    - Browser Info
    - Show Log
    - +
    - Site Footer
    - +
    - Those "BACK" Buttons
    +
  - + Via Misconfiguration +
    - Missing HTTPOnly Attribute
    +
  - + Against HTML 5 Storage +
    - HTML5 Storage
    +
  - + Against JSON +
    - Pen Test Tool Lookup
    +
  - + Via Cookie Injection +
    - Capture Data Page
    +
  +
- + + A3 - Broken Authentication and Session Management + +
  - Cookies
  - Login
  - View User Privileges
  +
- + A4 - Insecure Direct Object References +
  - Source Viewer
  - Credits
  - Cookies
  - Arbitrary File Inclusion
  +
- + A5 - Cross Site Request Forgery (CSRF) +
  - Add to your blog
  - Register User
  +
- + A6 - Security Misconfiguration +
  - Directory Browsing
  - Method Tampering (GET for POST)
  +
- + A7 - Insecure Cryptographic Storage +
  - User Info
  - HTML5 Storage
  +
- + A8 - Failure to Restrict URL Access +
  - Source Viewer
  - "Secret" Administrative Pages
  - Robots.txt
  +
- + A9 - Insufficient Transport Layer Protection +
  - Login
  - User Info
  +
- + A10 - Unvalidated Redirects and Forwards +
  - Credits
  +
+
+ HTML 5 +
- + HTML 5 Web Storage +
  - HTML5 Storage
  +
- + JavaScript Object Notation (JSON) +
  - Pen Test Tool Lookup
  - Pen Test Tool Lookup (AJAX)
  +
- + Asyncronous JavaScript and XML (AJAX) +
  - Pen Test Tool Lookup (AJAX)
  +
+
+ Others +
- + OWASP 2007 A3 - Malicious File Execution +
  - Source Viewer
  +
- + OWASP 2007 A6 - Information Leakage and Improper Error Handling +
  +
- + Denial of Service +
  - Show Web Log
  - +
  +
- + JavaScript "Security" +
  - Login
  - User Info
  - Add to your blog
  - HTML5 Storage
  +
- + User-Agent Impersonation +
- + Data Capture Pages +
  - Data Capture
  - View Captured Data
  +
+
+ Documentation +
- Listing of Vulnerabilities
+

+
+