45 Ways Fetching HTML Code Can Get You Hacked

1. Inspect Element (Ctrl+I)
                
                
                    Test Page
                    
                        
Hello World
2. Use Browser Developer Tools (F12)
3. Burp Suite
                
                
                    POST /submit HTTP/1.1
                    Content-Type: application/x-www-form-urlencoded
                    Content-Length: 24
                    Authorization: Basic dGVjaG8gUGVsbGUp
                    Host: example.com
                    
                        username=admin&password=123456
4. XSS Vulnerabilities
5. SQL Injection
                
                
                    SELECT * FROM users WHERE id = 1';
                    -- comment out
6. CSRF Attacks
7. Cross Site Scripting
8. Man-in-the-Middle Attacks
                
                
                    GET /index.html HTTP/1.1
                    Host: example.com
                    Connection: close
9. Directory Traversal
                
                
                    GET /../../etc/passwd HTTP/1.1
                    Host: example.com
10. Remote Code Execution
                
                
                    echo "Hello from server" > /var/www/html/index.html
11. Broken Authentication
12. Undersecure Services
                
                
                    GET /api/data?param=unauthorized HTTP/1.1
                    Host: api.example.com
13. Missing Input Validation
14. XSS in Forms
15. CSRF Tokens
16. File Upload Exploits
17. Server Configuration Flaws
                
                
                    GET /config HTTP/1.1
                    Host: server.example.com
18. Improper Access Control
                
                
                    GET /admin HTTP/1.1
                    Host: admin.example.com
19. Insecure Protocols
                
                
                    GET /images/photo.png?k=5ca85618-6e6b-40cc-9f85-e63fcd4bbfa4 HTTP/1.1
                    Host: image.example.com
20. Malicious JavaScript
21. Bypassing Security Measures
                
                
                    GET /security HTTP/1.1
                    Host: security.example.com
22. Exploiting XML Injections
                
                
                    GET /xml HTTP/1.1
                    Host: xml.example.com
                    Content-type: application/xml
23. Malformed HTML
                
                
                    
                        

                            

                                Invalid HTML
24. Misconfigured APIs
                
                
                    GET /api/user?id=1 HTTP/1.1
                    Host: api.example.com
25. Unpatched Vulnerabilities
                
                
                    GET /vulnerability HTTP/1.1
                    Host: vulnerability.example.com
26. Cross-Site Request Forgery
                
                
                    POST /login HTTP/1.1
                    Host: login.example.com
                    Content-length: 34
27. Default Configurations
                
                
                    GET /config HTTP/1.1
                    Host: config.example.com
28. Insecure Cookies
                
                
                    GET /cookie HTTP/1.1
                    Host: cookie.example.com
29. Misconfigured Logging
                
                
                    GET /log HTTP/1.1
                    Host: log.example.com
30. Improper Rate Limiting
                
                
                    GET /rate_limit HTTP/1.1
                    Host: rate_limit.example.com
31. Misdirected Redirects
                
                
                    GET /redirect HTTP/1.1
                    Host: redirect.example.com
32. Weak Cryptography
                
                
                    GET /crypt HTTP/1.1
                    Host: crypt.example.com
33. Denial of Service (DoS)
                
                
                    GET /denial_of_service HTTP/1.1
                    Host: denial-of-service.example.com
34. Poor API Design
                
                
                    GET /api/endpoint HTTP/1.1
                    Host: api.example.com
35. Incorrect JSON Parsing
                
                
                    {"key": "value"}
36. Improper Session Management
                
                
                    GET /session HTTP/1.1
                    Host: session.example.com
37. Poor Form Handling
38. Malformed CGI Scripts
                
                
                    GET /cgi-bin/script.cgi HTTP/1.1
                    Host: cgi-bin.example.com
39. Improperly Signed APIs
                
                
                    GET /api/sig HTTP/1.1
                    Host: api.example.com
40. Unvalidated Redirects
                
                
                    GET /redirect HTTP/1.1
                    Host: redirect.example.com
41. Malformed XML
                
                
                    
                        
                            Malformed XML
42. Exploitable Protocols
                
                
                    GET /protocol HTTP/1.1
                    Host: protocol.example.com
43. Insecure SSL/TLS
                
                
                    GET /ssl HTTP/1.1
                    Host: ssl.example.com
44. Insecure File System Permissions
                
                
                    GET /fs HTTP/1.1
                    Host: fs.example.com
45. Misconfigured DNS Settings
                
                
                    GET /dns HTTP/1.1
                    Host: dns.example.com