Replace dead links with archived copies and update outdated sources by enesbaldemir · Pull Request #1553 · OWASP/wstg

enesbaldemir · 2026-10-09T15:35:33Z

Part of #1550.

You have validated the need for this change.
If this PR is one of several related changes, note what remains.

What did this PR accomplish?

Follow-up to #1549. This resolves most of the dead and outdated links listed in #1550.

Dead links → Wayback Machine snapshots (each snapshot checked manually and shows the original article)

Original	Snapshot
sebastian-lekies.de/leak/	`web/20210107144812`
blog.isc2.org ... the-attack-of-t.html	`web/20150929111825`
carvesystems.com ... graphql-security-vulnerabilities	`web/20210126172623`
portswigger.net/daily-swig/path-confusion-...	`web/20230120114007`
searchsecurity.techtarget.com ... input-validation-attacks	`web/20151205182440`
software-security.sans.org ... secure-file-uploads	`web/20191018083805`
software-security.sans.org ... fix-sql-injection-in-java-hibernate	`web/20191122124952`
lanmaster53.com ... exploring-ssti-flask-jinja2	`web/20210227005613`
lanmaster53.com ... multi-post-csrf	`web/20210516151741`
nginx.com/blog/http-strict-transport-security-hsts-and-nginx	`web/20221224121012`
techrepublic.com ... referential-integrity ... oracle	`web/20160423081903`
veracode.com/security/format-string	`web/20191112191201`
whitehatsec.com/glossary/content/xml-injection	`web/20210215162552`

Replaced with the current source

OAuth 2.0 Security BCP draft (draft-ietf-oauth-security-topics, -16) → RFC 9700. The section anchors #section-2.1.2 (Implicit Grant) and #section-2.4 (Resource Owner Password Credentials Grant) match.
angular.io/guide/security (now redirects to the v17 legacy docs) → https://angular.dev/best-practices/security
AWS Lambda security-best-practices.html (redirect loop) → https://docs.aws.amazon.com/lambda/latest/dg/lambda-security.html
CIS-CAT Lite blog post (removed) → https://learn.cisecurity.org/cis-cat-lite
PCI DSS v3.2.1 PDF (retired; now lands on the library) → https://www.pcisecuritystandards.org/document_library/
www.wikipedia.org/wiki/Local_File_Inclusion → https://en.wikipedia.org/wiki/File_inclusion_vulnerability (canonical article)
Removed the PentesterAcademy link (the site now redirects to INE). It was the only item under "Videos", so the empty heading was removed too.

markdownlint-cli2 and the terminology textlint check pass on all changed files.

Remaining in #1550 (changes the meaning of the text, so I left these to the maintainers): NIST SP 800-63-3 → 800-63-4 (anchors and the PBKDF2 iteration guidance changed), FIPS 140-2 → 140-3, Proactive Controls v3 C5/C10 → 2024 C3, W3C CORS → Fetch Standard, Laravel 7.x docs, the PCI DSS v3.2.x SAQ PDFs, and blog.checkpoint.com/latest-sql-injection-trends/ (loads fine in a browser).

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

kingthorin

Maybe I'm expecting too much, this is just the first bit of a review. I didn't want to keep going and swamp you. Let me know what you're up for.

kingthorin · 2026-10-09T21:14:45Z

 ```

-Web spiders/robots/crawlers can [intentionally ignore](https://blog.isc2.org/isc2_blog/2008/07/the-attack-of-t.html) the `Disallow` directives specified in a `robots.txt` file. Hence, `robots.txt` should not be considered as a mechanism to enforce restrictions on how web content is accessed, stored, or republished by third parties.
+Web spiders/robots/crawlers can [intentionally ignore](https://web.archive.org/web/20150929111825/http://blog.isc2.org/isc2_blog/2008/07/the-attack-of-t.html) the `Disallow` directives specified in a `robots.txt` file. Hence, `robots.txt` should not be considered as a mechanism to enforce restrictions on how web content is accessed, stored, or republished by third parties.


Is this refer nice worth keeping?

If so I'd suggest seeking for something newer.

Replaced with Cloudflare's 2025 report on stealth crawlers ignoring robots.txt, which matches "intentionally ignore" directly.

kingthorin · 2026-10-09T21:15:22Z

 - [Chromium HSTS Preload List Source](https://chromium.googlesource.com/chromium/src/+/main/net/http/transport_security_state_static.json)
 - [MDN: Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security)
- [Enable HTTP Strict Transport Security In Nginx](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)
+- [Enable HTTP Strict Transport Security In Nginx](https://web.archive.org/web/20221224121012/https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)


There's gotta be a current Nginx ref for this

Found it, the post moved to blog.nginx.org. Updated to the live URL.

kingthorin · 2026-10-09T21:16:02Z


 - [Bypassing Web Cache Poisoning Countermeasures](https://portswigger.net/research/bypassing-web-cache-poisoning-countermeasures)
- [Path confusion: Web cache deception threatens user information online](https://portswigger.net/daily-swig/path-confusion-web-cache-deception-threatens-user-information-online)
+- [Path confusion: Web cache deception threatens user information online](https://web.archive.org/web/20230120114007/https://portswigger.net/daily-swig/path-confusion-web-cache-deception-threatens-user-information-online)


This isn't still available?

No, The Daily Swig was shut down and the URL now redirects to the PortSwigger homepage. I replaced it with the research paper that article was reporting on: "Cached and Confused: Web Cache Deception in the Wild" (USENIX Security 2020).

kingthorin · 2026-10-09T21:17:19Z

 - [Cross-site Request Forgery FAQ](https://www.cgisecurity.com/csrf-faq.html)
 - [A Most-Neglected Fact About Cross Site Request Forgery (CSRF)](https://yehg.net/lab/pr0js/view.php/A_Most-Neglected_Fact_About_CSRF.pdf)
- [Multi-POST CSRF](https://www.lanmaster53.com/2013/07/17/multi-post-csrf/)
+- [Multi-POST CSRF](https://web.archive.org/web/20210516151741/https://www.lanmaster53.com/2013/07/17/multi-post-csrf/)


Is his blog gone or just reorganized?

Reorganized: the blog moved to a /blog/YYYY/MM/DD/ URL scheme, but these 2013/2016 posts weren't carried over (old URLs 404 or loop, and I couldn't find them under the new structure). So I kept the archive link for this one.

kingthorin · 2026-10-09T23:05:20Z

 ## References

- [XML Injection](https://www.whitehatsec.com/glossary/content/xml-injection)
+- [XML Injection](https://web.archive.org/web/20210215162552/https://www.whitehatsec.com/glossary/content/xml-injection)


If this is just a definition (glossary entry) may as well point to Wikipedia

Wikipedia doesn't have an article on XML injection (only on XXE), so I pointed it to PortSwigger's definition instead.

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

enesbaldemir · 2026-10-10T05:58:30Z

Not too much at all, thanks for the detailed review! I've addressed these comments, so feel free to continue with the rest whenever you have time.

kingthorin · 2026-10-10T12:22:45Z

Thanks @enesbaldemir I'll try to complete the rest later tonight (Saturday, eastern).

kingthorin · 2026-10-14T23:20:18Z

Finally got back to this.

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

github-actions · 2026-10-15T10:07:12Z

The following links are broken:
FILE:base/document/4-Web_Application_Security_Testing/07-Injection/13-Format_String_Injection.md
[❌] https://www.defcon.org/images/defcon-18/dc-18-presentations/Haas/DEFCON-18-Haas-Adv-Format-String-Attacks.pdf → Status: 0

enesbaldemir · 2026-10-15T10:09:22Z

The link check flagged two pre-existing links in files this PR touches. The SEI "Securing Public Web Servers" PDF moved (SEI reorganized its site), so I've updated it to the new library page. The other one is the DEF CON 18 PDF from before, which loads fine manually.

kingthorin

Thank you!!!

Replace dead links with archived copies and update outdated sources

074748c

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

This comment has been minimized.

Sign in to view

kingthorin reviewed Oct 9, 2026

View reviewed changes

Address review: use current sources where available

7bc0b82

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

This comment has been minimized.

Sign in to view

kingthorin reviewed Oct 14, 2026

View reviewed changes

Address review round 2: use live sources, drop dated reference

c88244b

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

This comment has been minimized.

Sign in to view

Update moved SEI Securing Public Web Servers link

eea3b0e

Signed-off-by: enesbaldemir <enesbaldemir9538@gmail.com>

kingthorin approved these changes Oct 15, 2026

View reviewed changes

kingthorin merged commit 444193f into OWASP:master Oct 15, 2026
2 of 3 checks passed

Conversation

enesbaldemir commented Oct 9, 2026

Uh oh!

This comment has been minimized.

kingthorin left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

enesbaldemir commented Oct 10, 2026

Uh oh!

kingthorin commented Oct 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kingthorin commented Oct 14, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 15, 2026

Uh oh!

enesbaldemir commented Oct 15, 2026

Uh oh!

kingthorin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kingthorin left a comment •

edited

Loading