> For the complete documentation index, see [llms.txt](https://wiki.pentestlist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.pentestlist.com/offensive-security/web-application/exploitation.md).

# Exploitation

- [Authentication](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication.md): How to exploit web application authentication
- [Email Address Forms](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication/email-address-forms.md): How to exploit login and forgotten password forms.
- [AWS Cognito](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication/aws-cognito.md): How to exploit AWS Cognito.
- [JSON Web Tokens](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/json-web-tokens.md): How to exploit JSON Web Tokens.
- [Injection Attacks](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks.md): How to exploit injection attacks.
- [SQL Injection](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/sql-injection.md): How to exploit SQL and noSQL Injection.
- [Cross-Site Scripting](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/cross-site-scripting.md): How to exploit cross-site scripting (XSS).
- [HTTP Headers](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/http-headers.md): How to exploit HTTP Headers.