Replace dead links with archived copies and update outdated sources

document/4-Web_Application_Security_Testing/01-Information_Gathering/03-Review_Webserver_Metafiles_for_Information_Leakage.md

@@ -58,7 +58,7 @@ Disallow: /sdch
 ...
 ```
 
-Web spiders/robots/crawlers can [intentionally ignore](https://blog.isc2.org/isc2_blog/2008/07/the-attack-of-t.html) the `Disallow` directives specified in a `robots.txt` file. Hence, `robots.txt` should not be considered as a mechanism to enforce restrictions on how web content is accessed, stored, or republished by third parties.
+Web spiders/robots/crawlers can [intentionally ignore](https://blog.cloudflare.com/perplexity-is-using-stealth-undeclared-crawlers-to-evade-website-no-crawl-directives/) the `Disallow` directives specified in a `robots.txt` file. Hence, `robots.txt` should not be considered as a mechanism to enforce restrictions on how web content is accessed, stored, or republished by third parties.
 
 The `robots.txt` file is retrieved from the web root directory of the web server. For example, to retrieve the `robots.txt` from `www.google.com` using `wget` or `curl`:
 

document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/02-Application_Platform_Configuration.md

@@ -57,7 +57,7 @@ Comment review should be done in order to determine if any information is being
 
 Various tools, documents, or checklists can be used to give IT and security professionals a detailed assessment of the target systems' conformance to various configuration baselines or benchmarks. Such tools include, but are not limited to, the following:
 
-- [CIS-CAT Lite](https://www.cisecurity.org/blog/introducing-cis-cat-lite/)
+- [CIS-CAT Lite](https://learn.cisecurity.org/cis-cat-lite)
 - [Microsoft's Attack Surface Analyzer](https://github.com/microsoft/AttackSurfaceAnalyzer)
 - [NIST's National Checklist Program](https://ncp.nist.gov/repository)
 
@@ -152,11 +152,11 @@ For each framework in scope:
     - [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html), OWASP
     - [SP 800-92](https://csrc.nist.gov/publications/detail/sp/800-92/final) Guide to Computer Security Log Management, NIST
     - [PCI DSS](https://www.pcisecuritystandards.org/document_library) Requirement 10, PCI Security Standards Council
-    - [CERT Security Improvement Modules: Securing Public Web Servers](https://resources.sei.cmu.edu/asset_files/SecurityImprovementModule/2000_006_001_13637.pdf)
+    - [CERT Security Improvement Modules: Securing Public Web Servers](https://www.sei.cmu.edu/library/securing-public-web-servers/)
 - Containers and Serverless
     - [CIS Docker Benchmark](https://www.cisecurity.org/benchmark/docker)
     - [OWASP Serverless Top 10](https://owasp.org/www-project-serverless-top-10/)
-    - [AWS Lambda Security Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/security-best-practices.html)
+    - [AWS Lambda Security Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/lambda-security.html)
 - Framework Production Hardening
     - [Django Deployment Checklist](https://docs.djangoproject.com/en/stable/howto/deployment/checklist/)
     - [Flask Deployment Options](https://flask.palletsprojects.com/en/stable/deploying/)

document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/07-HTTP_Strict_Transport_Security.md

@@ -86,4 +86,4 @@ Because preload-list changes ship inside browser releases and are difficult/slow
 - [hstspreload.org - Preload List Submission Requirements](https://hstspreload.org/)
 - [Chromium HSTS Preload List Source](https://chromium.googlesource.com/chromium/src/+/main/net/http/transport_security_state_static.json)
 - [MDN: Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security)
-- [Enable HTTP Strict Transport Security In Nginx](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)
+- [Enable HTTP Strict Transport Security In Nginx](https://blog.nginx.org/blog/http-strict-transport-security-hsts-and-nginx)

document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/13-Path_Confusion.md

@@ -74,5 +74,5 @@ If the path `https://example.com/dashboard/none.js` is also opened by the user i
 ## References
 
 - [Bypassing Web Cache Poisoning Countermeasures](https://portswigger.net/research/bypassing-web-cache-poisoning-countermeasures)
-- [Path confusion: Web cache deception threatens user information online](https://portswigger.net/daily-swig/path-confusion-web-cache-deception-threatens-user-information-online)
+- [Cached and Confused: Web Cache Deception in the Wild (USENIX Security 2020)](https://www.usenix.org/conference/usenixsecurity20/presentation/mirheidari)
 - [Web Cache Deception Attack](https://omergil.blogspot.com/2017/02/web-cache-deception-attack.html)

document/4-Web_Application_Security_Testing/05-Authorization/05-OAuth_Weaknesses.md

@@ -29,8 +29,8 @@ In order to provide access to a client application, OAuth relies on several [aut
 
 Two flows will be deprecated in the release of [OAuth2.1](https://oauth.net/2.1/), and their usage is not recommended:
 
-- [Implicit Flow*](https://oauth.net/2/grant-types/implicit/): PKCE's secure implementation renders this flow obsolete. Prior to PKCE, the implicit flow was used by client-side applications such as [single page applications](https://en.wikipedia.org/wiki/Single-page_application) since [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS) relaxed the [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Same-origin_policy) for sites to inter-communicate. For more information on why the implicit grant is not recommended, review this [section](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1.2).
-- [Resource Owner Password Credentials](https://oauth.net/2/grant-types/password/):used to exchange users' credentials directly with the client, which then sends them to the authorization to exchange them for an access token. For information on why this flow is not recommended, review this [section](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.4).
+- [Implicit Flow*](https://oauth.net/2/grant-types/implicit/): PKCE's secure implementation renders this flow obsolete. Prior to PKCE, the implicit flow was used by client-side applications such as [single page applications](https://en.wikipedia.org/wiki/Single-page_application) since [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS) relaxed the [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Same-origin_policy) for sites to inter-communicate. For more information on why the implicit grant is not recommended, review this [section](https://datatracker.ietf.org/doc/html/rfc9700#section-2.1.2).
+- [Resource Owner Password Credentials](https://oauth.net/2/grant-types/password/):used to exchange users' credentials directly with the client, which then sends them to the authorization to exchange them for an access token. For information on why this flow is not recommended, review this [section](https://datatracker.ietf.org/doc/html/rfc9700#section-2.4).
 
 *: The implicit flow in OAuth only is deprecated, yet is still a viable solution within Open ID Connect (OIDC) to retrieve `id_tokens`. Be careful to understand how the implicit flow is being used, which can be identified if only the `/authorization` endpoint is being used to gain an access token, without relying on `/token` endpoint in any way. An example on this can be found [here](https://auth0.com/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post).
 
@@ -187,5 +187,5 @@ Reviewing the HTML meta tags (although this tag is [not supported](https://caniu
 - [The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)
 - [The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750)
 - [OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819)
-- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-16)
+- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/rfc9700)
 - [Authorization Code Flow with Proof Key for Code Exchange](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)

document/4-Web_Application_Security_Testing/05-Authorization/05.1-OAuth_Authorization_Server_Weaknesses.md

@@ -333,5 +333,5 @@ Proper configuration of security mitigation like CORS, anti-CSRF tokens, and ant
 - [The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)
 - [The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750)
 - [OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819)
-- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-16)
+- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/rfc9700)
 - [Authorization Code Flow with Proof Key for Code Exchange](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)

document/4-Web_Application_Security_Testing/05-Authorization/05.2-OAuth_Client_Weaknesses.md

@@ -99,5 +99,5 @@ To test for access token injection, follow the steps below. In this example, the
 - [The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)
 - [The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750)
 - [OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819)
-- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-16)
+- [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/rfc9700)
 - [Authorization Code Flow with Proof Key for Code Exchange](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)

document/4-Web_Application_Security_Testing/06-Session_Management/05-Cross_Site_Request_Forgery.md

@@ -191,5 +191,5 @@ When this data is sent as a POST request, the server will happily accept the nam
 - [Oldest known post](https://web.archive.org/web/20000622042229/https://www.zope.org/Members/jim/ZopeSecurity/ClientSideTrojan)
 - [Cross-site Request Forgery FAQ](https://www.cgisecurity.com/csrf-faq.html)
 - [A Most-Neglected Fact About Cross Site Request Forgery (CSRF)](https://yehg.net/lab/pr0js/view.php/A_Most-Neglected_Fact_About_CSRF.pdf)
-- [Multi-POST CSRF](https://www.lanmaster53.com/2013/07/17/multi-post-csrf/)
+- [Multi-POST CSRF](https://www.lanmaster53.com/blog/2013/07/17/multi-post-csrf/)
 - [SANS Pen Test Webcast: Complete Application pwnage via Multi POST XSRF](https://www.youtube.com/watch?v=EOs5PZiiwug)

document/4-Web_Application_Security_Testing/07-Injection/05.7-ORM_Injection.md

@@ -20,7 +20,7 @@ After identifying the possible ORM being used, it becomes essential to understan
 
 #### Weak ORM Implementation
 
-A vulnerable scenario where the ORM layer was not implemented properly, taken from [SANS](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-hibernate):
+A vulnerable scenario where the ORM layer was not implemented properly, taken from [SANS](https://web.archive.org/web/20191122124952/https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-hibernate):
 
 ```java
 List results = session.createQuery("from Orders as orders where orders.id = " + currentOrder.getId()).list();

document/4-Web_Application_Security_Testing/07-Injection/07-XML_Injection.md

@@ -530,7 +530,7 @@ For authoritative, parser-specific configuration snippets, defer to the [XML Ext
 
 ## References
 
-- [XML Injection](https://www.whitehatsec.com/glossary/content/xml-injection)
+- [PortSwigger: XML injection](https://portswigger.net/kb/issues/00100700_xml-injection)
 - [Gregory Steuck, "XXE (XML eXternal Entity) attack"](https://seclists.org/bugtraq/2002/Oct/420)
 - [OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
 - [PortSwigger Web Security Academy - XML External Entity (XXE) Injection](https://portswigger.net/web-security/xxe)

document/4-Web_Application_Security_Testing/07-Injection/11.1-File_Inclusion.md

@@ -134,7 +134,7 @@ Check out the [File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheat
 
 ## References
 
-- [Wikipedia](https://www.wikipedia.org/wiki/Local_File_Inclusion)
+- [Wikipedia](https://en.wikipedia.org/wiki/File_inclusion_vulnerability)
 - [Null character](https://en.wikipedia.org/wiki/Null_character)
 - [Unicode Encoding](https://owasp.org/www-community/attacks/Unicode_Encoding)
 - [Double Encoding](https://owasp.org/www-community/Double_Encoding)

document/4-Web_Application_Security_Testing/07-Injection/13-Format_String_Injection.md

@@ -8,7 +8,7 @@
 
 A format string is a null-terminated character sequence that also contains conversion specifiers interpreted or converted at runtime. If server-side code [concatenates a user's input with a format string](https://www.invicti.com/blog/web-security/string-concatenation-format-string-vulnerabilities), an attacker can append additional conversion specifiers to cause a runtime error, information disclosure, or buffer overflow.
 
-The worst case for format strings vulnerabilities occur in languages that don't check arguments and also include a `%n` specifier that writes to memory. These functions, if exploited by an attacker modifying a format string, could cause [information disclosure and code execution](https://www.veracode.com/security/format-string):
+The worst case for format strings vulnerabilities occur in languages that don't check arguments and also include a `%n` specifier that writes to memory. These functions, if exploited by an attacker modifying a format string, could cause [information disclosure and code execution](https://en.wikipedia.org/wiki/Uncontrolled_format_string):
 
 - C and C++ [printf](https://en.cppreference.com/w/c/io/fprintf) and similar methods fprintf, sprintf, snprintf
 - Perl [printf](https://perldoc.perl.org/functions/printf.html) and sprintf

document/4-Web_Application_Security_Testing/07-Injection/18-Server-side_Template_Injection.md

@@ -129,7 +129,7 @@ The tester can also identify what other objects, methods and properties can be e
 
 - [James Kettle: Server-Side Template Injection:RCE for the modern webapp (whitepaper)](https://portswigger.net/kb/papers/serversidetemplateinjection.pdf)
 - [Server-Side Template Injection](https://portswigger.net/blog/server-side-template-injection)
-- [Exploring SSTI in Flask/Jinja2](https://www.lanmaster53.com/2016/03/exploring-ssti-flask-jinja2/)
+- [Exploring SSTI in Flask/Jinja2](https://www.lanmaster53.com/blog/2016/03/09/exploring-ssti-flask-jinja2/)
 - [Server-Side Template Injection: from detection to Remote shell](https://www.okiok.com/server-side-template-injection-from-detection-to-remote-shell/)
 - [Extreme Vulnerable Web Application](https://github.com/s4n7h0/xvwa)
 - [Exploiting SSTI in Thymeleaf](https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/)

document/4-Web_Application_Security_Testing/10-Business_Logic/03-Integrity_Checks.md

@@ -72,5 +72,5 @@ The application should follow strict access controls on how data and artifacts c
 
 - [Implementing Referential Integrity and Shared Business Logic in a RDB](https://agiledata.org/essays/referentialIntegrity.html)
 - [On Rules and Integrity Constraints in Database Systems](https://www.comp.nus.edu.sg/~lingtw/papers/IST92.teopk.pdf)
-- [Use referential integrity to enforce basic business rules in Oracle](https://www.techrepublic.com/article/use-referential-integrity-to-enforce-basic-business-rules-in-oracle/)
+- [Use referential integrity to enforce basic business rules in Oracle](https://web.archive.org/web/20160423081903/http://www.techrepublic.com/article/use-referential-integrity-to-enforce-basic-business-rules-in-oracle/)
 - [Maximizing Business Logic Reuse with Reactive Logic](https://web.archive.org/web/20221116203934/https://dzone.com/articles/maximizing-business-logic)

document/4-Web_Application_Security_Testing/10-Business_Logic/09-Upload_of_Malicious_Files.md

@@ -217,7 +217,7 @@ Fully protecting against malicious file upload can be complex, and the exact ste
 - [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
 - [OWASP - Unrestricted File Upload](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload)
 - [Why File Upload Forms are a Major Security Threat](https://www.acunetix.com/websitesecurity/upload-forms-threat/)
-- [8 Basic Rules to Implement Secure File Uploads](https://software-security.sans.org/blog/2009/12/28/8-basic-rules-to-implement-secure-file-uploads)
+- [8 Basic Rules to Implement Secure File Uploads](https://www.sans.org/blog/8-basic-rules-to-implement-secure-file-uploads)
 - [Stop people uploading malicious PHP files via forms](https://stackoverflow.com/questions/602539/stop-people-uploading-malicious-php-files-via-forms)
 - [How to Tell if a File is Malicious](https://web.archive.org/web/20210710090809/https://www.techsupportalert.com/content/how-tell-if-file-malicious.htm)
 - [CWE-434: Unrestricted Upload of File with Dangerous Type](https://cwe.mitre.org/data/definitions/434.html)

document/4-Web_Application_Security_Testing/10-Business_Logic/10-Payment_Functionality.md

@@ -339,5 +339,5 @@ Ensure that the application correctly handles such cases and prevents exploitati
 
 ## References
 
-- [Payment Card Industry Data Security Standard (PCI DSS)](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf)
+- [Payment Card Industry Data Security Standard (PCI DSS)](https://www.pcisecuritystandards.org/document_library/)
 - [Visa Processing E-Commerce Payments guidance](https://web.archive.org/web/2023/https://www.visa.co.uk/dam/VCOM/regional/ve/unitedkingdom/PDF/risk/processing-e-commerce-payments-guide-73-17337.pdf)

document/4-Web_Application_Security_Testing/11-Client-side/13-Cross_Site_Script_Inclusion.md

@@ -160,7 +160,7 @@ In this example, using the `___` columns as injection points and inserting JavaS
 
 ### 4. Sensitive Data Leakage via Prototype Chaining Using `this`
 
-In JavaScript, the `this` keyword is dynamically scoped. This means if a function is called upon an object, `this` will point to this object even though the called function might not belong to the object itself. This behavior can be used to leak data. In the following example from [Sebastian Leike's demonstration page](http://sebastian-lekies.de/leak/), the sensitive data is stored in an Array. An attacker can override `Array.prototype.forEach` with an attacker-controlled function. If some code calls the `forEach` function on an array instance that contains sensitive values, the attacker-controlled function will be invoked with `this` pointing to the object that contains the sensitive data.
+In JavaScript, the `this` keyword is dynamically scoped. This means if a function is called upon an object, `this` will point to this object even though the called function might not belong to the object itself. This behavior can be used to leak data. In the following example from [Sebastian Leike's demonstration page](https://web.archive.org/web/20210107144812/http://sebastian-lekies.de/leak/), the sensitive data is stored in an Array. An attacker can override `Array.prototype.forEach` with an attacker-controlled function. If some code calls the `forEach` function on an array instance that contains sensitive values, the attacker-controlled function will be invoked with `this` pointing to the object that contains the sensitive data.
 
 Here is an excerpt of a JavaScript file containing sensitive data, `javascript.js`:
 

document/4-Web_Application_Security_Testing/11-Client-side/15-Client-Side_Template_Injection.md

@@ -167,5 +167,5 @@ Look for `unsafe-eval` in the CSP. Many template engines (especially older ones)
 - [PortSwigger: Client-Side Template Injection](https://portswigger.net/research/server-side-template-injection)
 - [Gareth Heyes: Angular Sandbox Bypasses](https://portswigger.net/research/dom-based-angularjs-sandbox-escapes)
 - [Vue.js Security Guide](https://vuejs.org/guide/best-practices/security.html)
-- [Angular Security Guide](https://angular.io/guide/security)
+- [Angular Security Guide](https://angular.dev/best-practices/security)
 - [{% raw %}{{alert(’CSTI’)}}{% endraw %}: Large-Scale Detection of Client-Side Template Injection](https://ieeexplore.ieee.org/document/11352459)

document/4-Web_Application_Security_Testing/12-API_Testing/99-GraphQL.md

@@ -634,7 +634,7 @@ For more on remediating GraphQL weaknesses, refer to the [GraphQL Cheat Sheet](h
 - [Howtographql - Security](https://www.howtographql.com/advanced/4-security/)
 - [GraphQL Constraint Directive](https://github.com/confuser/graphql-constraint-directive)
 - [Client-side Testing](../11-Client-side/README.md) (XSS and other vulnerabilities)
-- [5 Common GraphQL Security Vulnerabilities](https://carvesystems.com/news/the-5-most-common-graphql-security-vulnerabilities/)
+- [5 Common GraphQL Security Vulnerabilities](https://web.archive.org/web/20210126172623/https://carvesystems.com/news/the-5-most-common-graphql-security-vulnerabilities/)
 - [GraphQL common vulnerabilities and how to exploit them](https://medium.com/@the.bilal.rizwan/graphql-common-vulnerabilities-how-to-exploit-them-464f9fdce696)
 - [GraphQL CS](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html)
 - [GraphQL Enumeration Basics](https://blog.cyberadvisors.com/technical-blog/blog/graphql-apis-enumeration-basics)