// Web app vulnerabilities — XSS, SQLi, SSRF, IDOR
Finished [Operation: First Flag](https://hacking.community/ctf/ctf_first_win)? Before moving on, write down what told you the transmission was *encoded*, not encrypted. Now open [Web Hacking Fundamentals](https://hacking.community/learn/we
Found a PDF generator endpoint that fetched user-supplied URLs. Pointed it at `169.254.169.254` and got IAM role creds. $2k bounty.
One session cookie keeps you signed in. Optional analytics load only if you accept — never ad trackers. Cookie Policy · Privacy Policydetails
Install hacking.community for fast access, offline reading, and push notifications. No app store needed.