Expert-level revision notes for web application security interviews (senior and staff security engineer). Each document is one topic, written as answers to the rabbit-hole follow-ups an interviewer asks, without the questions themselves. The content is grounded in real industry sources (PortSwigger Web Security Academy, OWASP cheat sheets and Top 10s, the relevant RFCs and protocol specs, and named public research), and each doc cites what it drew from.
This is a revision aid, not a tutorial . It assumes deep prior knowledge and reloads the technique-level detail fast: protocol breakdowns, concrete payloads, blind and out-of-band variants, escalation to RCE or account takeover, and the mitigations that actually hold.
Every doc follows the same shape
Mental model : the one-paragraph root cause.How it works : the protocol or technology breakdown (wire format, headers, spec behaviors) where relevant.Attack techniques : enumerated, each with the mechanism, a real payload or wire example, blind/OOB variants, how you confirm it, and why it works. Named techniques, CVEs, and researchers where sourced.Defense : specific and ordered by effectiveness, separating the real fix from defense-in-depth.Interview-grade nuances : the subtle senior-vs-junior points and common wrong answers.Sources : the real references used.
Server-side and injection
#
Topic
Focus
01
SQL injection UNION/error/boolean/time/OOB, per-DBMS metadata, binary-search extraction, file/RCE, WAF bypass
20
NoSQL injection Operator vs syntax injection, $ne/$gt/$regex/$where, auth bypass, blind extraction
05
OS command injection Shell vs argv sinks, blind time/OOB, argument injection, filter/space bypass
11
Path traversal & file inclusion Encoding bypass, PHP wrappers, log/session poisoning, LFI to RCE
06
XXE injection In-band/blind OOB, XXE to SSRF, SVG/OOXML vectors, per-parser hardening
07
SSTI Engine fingerprinting, object-graph to RCE per engine, sandbox escapes
08
Insecure deserialization Gadget chains, ysoserial/phpggc, polymorphic JSON typing, allowlists
04
SSRF Cloud metadata, gopher/Redis, DNS rebinding, parser bypass, IMDSv2
10
File upload Extension/content-type bypass, polyglots, SVG/XXE, Zip Slip, upload to RCE
Access control, authentication, and logic
#
Topic
Focus
15
Access control & IDOR IDOR/BOLA/BFLA, mass assignment, multi-tenant, two-account testing
12
Authentication & session Stuffing/spraying, MFA bypass, reset poisoning, fixation, cookie security
16
Business logic & race conditions TOCTOU, limit-overrun, single-packet attack, workflow abuse
21
Information disclosure Verbose errors, .git/.env, source maps, introspection, discovery
#
Topic
Focus
02
Cross-site scripting (XSS) Reflected/stored/DOM/mXSS, self-XSS escalation, CSP bypass, impact
03
CSRF SameSite nuance, token failures, login/logout CSRF, XSS x CSRF chain
18
CORS misconfiguration Reflected/null origin, weak validation, credentialed read exploit
22
Clickjacking UI redress, drag-and-drop, framebusting bypass, frame-ancestors
23
WebSockets Handshake internals, CSWSH, message injection, Origin validation
24
Prototype pollution __proto__/constructor vectors, client gadgets, server RCE, defenses
HTTP, caching, and protocol attacks
#
Topic
Focus
09
HTTP request smuggling CL.TE/TE.CL/TE.TE, HTTP/2 downgrade, client-side desync, impact
25
HTTP Host header attacks Reset poisoning, routing SSRF, cache poisoning, vhost access
26
Web cache poisoning Unkeyed inputs, gadgets, cache-key flaws, param cloaking
27
Web cache deception Path confusion, delimiter/normalization discrepancies, defenses
Identity, tokens, and APIs
#
Topic
Focus
14
OAuth 2.0 & OIDC Grant types, redirect_uri/state/PKCE, scope upgrade, id_token validation
13
JWT attacks alg=none, RS256 to HS256 confusion, kid/jku injection, claim validation
28
GraphQL Introspection, resolver-level authz, batching abuse, query-depth DoS
29
API security (REST) OWASP API Top 10 2023, BOLA/BFLA/BOPLA, SSPP, mass assignment
Authentication protocols and federated identity
#
Topic
Focus
67
Single Sign-On (SSO) Trust delegation pattern, SP- vs IdP-initiated, SLO, IdP-compromise blast radius, Golden SAML
68
SAML 2.0 Bindings, assertion signing, XSW, comment truncation, InResponseTo binding, IdP-initiated CSRF
69
mTLS and client-certificate auth TLS 1.2 vs 1.3 handshake, SAN/CN matching, revocation, TLS-terminator header trust
70
WebAuthn, passkeys, and FIDO2 Registration/assertion ceremonies, RP ID + origin binding, attestation formats, sync passkeys vs device-bound
72
Session management deep dive Cookie flags, __Host- prefix, rotation, sliding vs absolute expiry, revocation model, hijacking vectors
73
MFA and step-up authentication TOTP/HOTP, push-fatigue, WebAuthn as MFA, acr/amr claims, step-up flows, MFA-bombing
75
Password authentication in 2026 Argon2id/scrypt/bcrypt tuning, NIST 800-63B rev4, breach-list checks, credential stuffing defenses
77
OpenID Connect deep dive id_token verification, nonce, discovery, RP-initiated + back-channel logout, PAR, JAR, FAPI
78
Token exchange and delegation RFC 8693, on-behalf-of, actor/may_act claims, RFC 8707 audience binding, downscoping
81
SPIFFE and SPIRE Workload identity, X.509 SVID, JWT SVID, workload attestation, federation, service-mesh mTLS
82
OpenID Federation Entity statements, trust chain to trust anchor, trust marks, automatic client registration
AI and agent security — overview and umbrella docs OWASP LLM Top 10 (2025) — one doc per class
#
Topic
Focus
33
Direct prompt injection LLM01a: role-token unreliability, jailbreak templates, universal adversarial suffixes, encoding evasion
34
Indirect prompt injection LLM01b: retrieved-content injection, ASCII smuggling, markdown-image exfil, EchoLeak
35
Sensitive information disclosure LLM02: training-data extraction, PII regurgitation, embedding inversion, RAG source leak
36
LLM supply chain LLM03: model/tokenizer/dataset supply chain, HuggingFace hub, poisoned fine-tunes
37
Data and model poisoning LLM04: training-time poisoning, instruction-tuning backdoors, sleeper agents, RLHF poisoning
38
Improper output handling LLM05: markdown-image exfil, SSRF via LLM-emitted URLs, XSS via chat rendering, sink recycling
39
Excessive agency LLM06: excessive functionality/permissions/autonomy, confused deputy in tool calls
40
System prompt leakage LLM07: extraction techniques, "secret system prompt" anti-pattern, credentials-in-prompt
41
Vector and embedding weaknesses LLM08: embedding poisoning, embedding inversion, cross-tenant retrieval bleed
42
Misinformation and hallucination grounding LLM09: package hallucination (slopsquatting), code-suggestion hallucination, verifier LLMs
43
Unbounded consumption (denial of wallet) LLM10: fan-out loops, token amplification, per-user budgets, cost anomaly detection
Agent-specific attack classes
#
Topic
Focus
44
Memory poisoning Persistent injection via long-term memory, cross-session persistence, cross-tenant memory bleed
45
Plan and goal hijacking Loop-level objective rewrite, multi-turn priming, two-shot elicitation
46
Cascading hallucination Multi-agent orchestration, cross-agent privilege laundering, weakest-agent exploitation
47
Human-in-the-loop bypass Approval fatigue, spoofed UI, auto-approve escape hatches, batch approval
48
Cross-agent trust and A2A injection Unauthenticated semantic content, agent registration abuse, shared-channel poisoning
49
Tool-schema confusion Typed-argument violations, semantic vs shape gap, sink recycling into 05/11/01/04
50
Credential passthrough and token scoping Over-broad scopes, RFC 8707 audience-binding violations, refresh-token leak via logs
51
Sandbox escape via tool composition Composition-level escape, shared workspaces, network egress through helper tools
52
MCP cross-server shadowing and tool poisoning Tool-description hijack across servers, rogue registry servers
53
Rug pull and tool-definition drift Metadata-plane supply chain, hash pinning at approval, manifest tables
54
Orchestrator prompt injection (template escape) Unescaped template variables, GitLab Duo MR-title, Notion AI title-field
AI/agent protocols and architectures
#
Topic
Focus
55
Model Context Protocol (MCP) deep dive JSON-RPC transport, capability negotiation, sampling, resource indicators, session semantics
56
A2A protocol Agent card discovery, task lifecycle, principal-and-authority binding, streaming updates
57
Function-calling protocols OpenAI tools, Anthropic tool-use, Gemini function-calling, schema semantics vs shape
58
RAG architecture and attack surface Ingestion/retrieval/generation stage-by-stage, chunker, reranker, prompt-assembly
59
Vector stores pgvector, Pinecone, Weaviate, Milvus, multi-tenancy, key scoping, RLS
60
Model serving and inference-API attacks vLLM, TGI, TensorRT-LLM, Triton, KV-cache side channels, batch timing
61
Guardrail systems Rebuff, Lakera, PromptGuard, LlamaGuard, NeMo Guardrails, Azure AI Content Safety, honest limits
62
Model file formats and loaders pickle RCE, safetensors, GGUF, ONNX, Fickling, allowlist safe formats
#
Topic
Focus
65
AI/agent defenses reference Least-privilege tool scoping, HITL, trust tiering, structured output, egress allowlists, audit
66
Spotlighting Delimiting, datamarking, encoding variants, invariant enforced, residuals
#
Topic
Focus
17
Cryptographic failures KDF tuning, padding oracle, IV/nonce reuse, length extension, AEAD
19
Security misconfiguration & headers Debug-to-RCE, exposed surfaces, the full security-header suite
83
Zero Trust Architecture NIST SP 800-207 tenets, PE/PA/PEP, 800-207A cloud-native workload identity, 1800-35 implementation, CISA ZTMM v2.0, deployment variants, ZT for AI agents
Container and orchestration
#
Topic
Focus
85
Kubernetes security 4 Cs model, API server / kubelet / etcd, RBAC and service-account tokens, Pod Security Admission (PSA), NetworkPolicy, admission control (Kyverno/Gatekeeper), workload identity
86
Container escape Namespaces + cgroups + capabilities as the boundary, privileged/hostPath escapes, runc/CRI-O CVEs (2019-5736, 2024-21626, 2022-0847 Dirty Pipe), cgroup release_agent, gVisor / kata isolation
Payments and money-movement
#
Topic
Focus
87
Payment and PII tokenization PSP / network (VTS/MDES) / device tokens, PCI DSS 4.0.1 scope de-scoping, token vault attacks, FPE weaknesses (FF1/FF3), keyed hashing for stored PAN
92
Money-movement authorization and idempotency Per-object authz + idempotency-key replay-detection, dynamic linking (amount+payee) under PSD2 SCA, race-condition double-spend, refund/hold-vs-capture abuse, velocity limits
#
Topic
Focus
95
Webhooks HMAC-SHA256 vs JWT-signed vs mTLS webhooks, timestamp binding to prevent replay, constant-time compare, SSRF via webhook dispatch, at-least-once delivery + receiver-side idempotency
If you are cramming, prioritise by interview frequency: XSS, SQLi, access control/IDOR, SSRF, CSRF, auth/session, JWT, OAuth , then request smuggling and the caching/host-header trio, then the AI/agent docs if the role touches LLM or MCP integrations.
For AI/agent-heavy roles: start at hubs 30 → 31 → 32, then walk the OWASP LLM Top 10 series 33–43 in order, then agent-specific attacks 44–54, then protocol deep dives 55–62, then defenses 65–66.
Global reference libraries These span almost every topic here and are worth bookmarking:
Scope: web application security, plus the adjacent AI/agent surface (LLM integrations and MCP). Defensive and educational revision material.