SQL injection is a type of attack where the attacker inserts malicious SQL queries into input fields to manipulate the database.

Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious scripts into webpages viewed by other users.

A web application firewall (WAF) is used to monitor and filter HTTP traffic to and from a web application to block malicious attacks.

Session hijacking occurs when an attacker steals a valid session token and impersonates the user to access their account or data.

The goal of a web application penetration test is to identify and exploit security vulnerabilities in a web application before malicious attackers can exploit them.

Input validation ensures that user inputs are checked for accuracy and validity before being processed, preventing malicious inputs like SQL injections and XSS.

HTTPS encrypts data between the user's browser and the web server, ensuring that the data transmitted cannot be intercepted by attackers.

A common method for testing SQL injection is inserting a single quote (') or other SQL syntax into input fields to check if the application is vulnerable.

CSRF is an attack that tricks the user into making an unwanted request to a web application in which they are authenticated, potentially causing harm to their account.