# Web

- [XSS Labs](/learning/labs-and-writeups/web/xss-labs.md): The goal of these labs are to bypass the filter that is given to you. To pass the level you have to pop an alert box with 'l33t'.
- [Padding Oracle](/learning/labs-and-writeups/web/padding-oracle.md)
- [Null Origin Exploitation](/learning/labs-and-writeups/web/null-origin-exploitation.md): Objective: Exploit the vulnerable application to perform Null Origin exploitation and steal the contents of the secret page.
- [PHP Insecure Deserialization](/learning/labs-and-writeups/web/php-insecure-deserialization.md)
- [Java Insecure Deserialization II](/learning/labs-and-writeups/web/java-insecure-deserialization-ii.md)
- [Java Insecure Deserialization I](/learning/labs-and-writeups/web/java-insecure-deserialization-i.md)
- [.NET Insecure Deserialization](/learning/labs-and-writeups/web/.net-insecure-deserialization.md)
- [Attacking OAuth](/learning/labs-and-writeups/web/attacking-oauth.md)
- [LDAP](/learning/labs-and-writeups/web/ldap.md)
- [HTML Adapter to Root](/learning/labs-and-writeups/web/html-adapter-to-root.md)
- [Insecure RMI](/learning/labs-and-writeups/web/insecure-rmi.md)
- [XSLT to Code Execution](/learning/labs-and-writeups/web/xslt-to-code-execution.md)
- [SSRF To RCE](/learning/labs-and-writeups/web/ssrf-to-rce.md)
- [SQL Injection](/learning/labs-and-writeups/web/sql-injection.md)
- [CSRF](/learning/labs-and-writeups/web/csrf.md)
