# az0x7/vulnerability-checklist architecture

> Architecture diagram of the GitHub repository az0x7/vulnerability-checklist, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-16). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/az0x7/vulnerability-checklist
- Repository: https://github.com/az0x7/vulnerability-checklist

## Overview

This repository is a documentation-only security checklist library, not an executable application. Its “architecture” is a curated set of Markdown notes grouped by vulnerability class, with a few supporting PDFs, text payloads, and YAML templates for framework-specific testing.

1. Core structure  
The repo is organized as one top-level folder per attack surface or vulnerability family. Each folder contains a single primary document, usually a Markdown checklist, that captures probing ideas, bypass techniques, and validation steps for that topic.

2. Main content domains  
The strongest architectural split is between identity/access-control topics and general web-exploitation topics. Identity-related areas include Authentication, API Authentication, API Authorization, 2FA Bypass, Account Takeover, Reset Password, Register Vulnerability, Cookie Attack, 403 Bypass, IDOR, and Admin Panel. These are the repo’s access and privilege boundaries.

3. Application-layer vulnerability cluster  
A second major subsystem covers classic web application flaws: CSRF, XSS/RXSS, Mass Assignment, Business Logic, JSON Attack, File Upload, SQL Injection, RCE, Rate Limit bypass, and EXIF geolocation leakage. These documents focus on request/response manipulation and server-side trust failures.

4. Framework-specific playbooks  
Two folders are dedicated to framework-oriented checklisting: Hacking Django and Hacking Symfony. These are more specialized than the generic web-checklists and imply framework-specific attack paths, misconfigurations, and templates.

5. Misconfiguration and platform exposure  
AEM misconfiguration is a separate category, indicating the repo also tracks platform-level exposure rather than only application bugs. This sits alongside the framework-specific content as a “technology target” layer.

6. Supporting artifact types  
Most content is Markdown, but there are also PDFs in File Upload, a SQL payload text file in Sql injection, and YAML templates in Hacking Django and Hacking Symfony. These auxiliary artifacts suggest the repo is meant as a practical field guide, with reusable payloads and template-based testing references.

7. Knowledge flow through the repo  
The effective data flow is from broad vulnerability category to specific checklist. A user likely starts at README.md, then follows the linked topic folder, then uses the local artifact files inside that folder as reference material for testing or triage.

8. README as the index layer  
README.md acts as the repository index and navigation boundary. It lists the major checklists, links them to their folders, and establishes the canonical set of topics the repo considers in scope.

9. Cross-cutting themes  
Several documents overlap conceptually: authentication, session/cookie handling, authorization, and account takeover are adjacent; likewise rate limiting, reset password, 2FA bypass, and register flows all belong to account lifecycle abuse. This overlap is important when drawing the architecture because these are not isolated silos.

10. Repository boundary  
There is no build pipeline, service runtime, database, or application backend in this repo. The only “runtime” concern is the human analyst using the docs as a playbook. So the architecture diagram should show a documentation hub with topic folders, not a software system with deployable components.

11. Practical diagramming model  
A clear architecture diagram would place README.md at the center as the entry point, branch into major security domains, then fan out into the individual checklist files and supporting payload/template artifacts. The key boundary is between index/navigation, domain checklists, and reusable supporting files.

Main entry points: [`README.md`](https://github.com/az0x7/vulnerability-checklist/blob/main/README.md) (README), [`Authentication/authentication.md`](https://github.com/az0x7/vulnerability-checklist/blob/main/Authentication/authentication.md) (Authentication), [`Hacking Symfony/Symfony.md`](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/Symfony.md) (Symfony), [`File Upload/File Upload.md`](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/File%20Upload/File%20Upload.md) (File Upload)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_index["Index"]
  node_readme["README<br/>index<br/>[README.md]"]
end

subgraph group_access["Access Control"]
  node_auth["Authentication<br/>checklist<br/>[authentication.md]"]
  node_api_auth["API Auth<br/>checklist<br/>[Authentication.md]"]
  node_api_authz["API AuthZ<br/>checklist<br/>[Authorization.md]"]
  node_twofa["2FA Bypass<br/>checklist<br/>[2FA bypass.md]"]
  node_ato["Account Takeover<br/>checklist<br/>[ATO.md]"]
  node_reset["Reset Password<br/>checklist"]
  node_register["Register Vuln<br/>checklist<br/>[register.md]"]
  node_cookie["Cookie Attack<br/>checklist<br/>[cookie.md]"]
  node_bypass403["403 Bypass<br/>checklist<br/>[403-bypass.md]"]
  node_idor["IDOR<br/>checklist<br/>[idor.md]"]
  node_admin["Admin Panel<br/>checklist<br/>[adminpanal.md]"]
end

subgraph group_web["Web Exploits"]
  node_csrf["CSRF<br/>checklist<br/>[csrf.md]"]
  node_xss["RXSS<br/>checklist<br/>[xss.md]"]
  node_mass["Mass Assignment<br/>checklist<br/>[Mass.md]"]
  node_logic["Business Logic<br/>checklist<br/>[bussiness logic.md]"]
  node_json["JSON Attack<br/>checklist<br/>[json.md]"]
  node_upload["File Upload<br/>checklist<br/>[File Upload.md]"]
  node_sql["SQL Injection<br/>checklist<br/>[sqlpayload.txt]"]
  node_rce["RCE<br/>checklist<br/>[Rce.md]"]
  node_rate["Rate Limit<br/>checklist"]
  node_exif["EXIF Geo<br/>checklist<br/>[exif_geo.md]"]
  node_tips1["Tips P1<br/>notes<br/>[tips_twitter.md]"]
  node_tips2["Tips P2<br/>notes<br/>[tips_twitter_P2.md]"]
end

subgraph group_framework["Framework Playbooks"]
  node_aem["AEM Misconfig<br/>checklist<br/>[aem.md]"]
  node_django["Django<br/>playbook<br/>[Django.md]"]
  node_symfony["Symfony<br/>playbook<br/>[Symfony.md]"]
end

subgraph group_artifacts["Artifacts"]
  node_django_yaml["Django YAML<br/>template"]
  node_symfony_t1["Symf T1<br/>template<br/>[template_1.yaml]"]
  node_symfony_t2["Symf T2<br/>template<br/>[template_2.yaml]"]
  node_symfony_t3["Symf T3<br/>template<br/>[template_3.yaml]"]
  node_symfony_t4["Symf T4<br/>template<br/>[template_4.yaml]"]
  node_file_pdf1["Upload PDF<br/>reference<br/>[File-Upload.pdf]"]
  node_file_pdf2["Upload Slides<br/>reference<br/>[Slides(1).pdf]"]
end

node_readme -->|"indexes"| node_auth
node_readme -->|"indexes"| node_api_auth
node_readme -->|"indexes"| node_api_authz
node_readme -->|"indexes"| node_twofa
node_readme -->|"indexes"| node_ato
node_readme -->|"indexes"| node_reset
node_readme -->|"indexes"| node_register
node_readme -->|"indexes"| node_idor
node_readme -->|"indexes"| node_admin
node_readme -->|"indexes"| node_csrf
node_readme -->|"indexes"| node_xss
node_readme -->|"indexes"| node_mass
node_readme -->|"indexes"| node_logic
node_readme -->|"indexes"| node_upload
node_readme -->|"indexes"| node_sql
node_readme -->|"indexes"| node_rce
node_readme -->|"indexes"| node_rate
node_readme -->|"indexes"| node_django
node_readme -->|"indexes"| node_symfony
node_readme -->|"indexes"| node_aem
node_auth -.->|"relates"| node_api_auth
node_auth -.->|"relates"| node_api_authz
node_auth -.->|"relates"| node_twofa
node_auth -.->|"relates"| node_ato
node_ato -.->|"adjacent"| node_reset
node_ato -.->|"adjacent"| node_register
node_api_authz -.->|"adjacent"| node_idor
node_cookie -.->|"supports"| node_auth
node_bypass403 -.->|"supports"| node_api_authz
node_csrf -.->|"depends on"| node_cookie
node_logic -.->|"adjacent"| node_rate
node_upload -.->|"enables"| node_rce
node_upload -.->|"references"| node_file_pdf1
node_upload -.->|"references"| node_file_pdf2
node_sql -.->|"adjacent"| node_json
node_django -.->|"uses"| node_django_yaml
node_symfony -.->|"uses"| node_symfony_t1
node_symfony -.->|"uses"| node_symfony_t2
node_symfony -.->|"uses"| node_symfony_t3
node_symfony -.->|"uses"| node_symfony_t4
node_readme -->|"indexes"| node_tips1
node_tips1 -.->|"continues"| node_tips2

click node_readme "https://github.com/az0x7/vulnerability-checklist/blob/main/README.md"
click node_auth "https://github.com/az0x7/vulnerability-checklist/blob/main/Authentication/authentication.md"
click node_api_auth "https://github.com/az0x7/vulnerability-checklist/blob/main/Api Authentication /Authentication.md"
click node_api_authz "https://github.com/az0x7/vulnerability-checklist/blob/main/Api Authorization/Authorization.md"
click node_twofa "https://github.com/az0x7/vulnerability-checklist/blob/main/2FA Bypass/2FA bypass.md"
click node_ato "https://github.com/az0x7/vulnerability-checklist/blob/main/Acount takeover/ATO.md"
click node_reset "https://github.com/az0x7/vulnerability-checklist/blob/main/reset password/reset_password_checklist.md"
click node_register "https://github.com/az0x7/vulnerability-checklist/blob/main/register vulnerability/register.md"
click node_cookie "https://github.com/az0x7/vulnerability-checklist/blob/main/Cookie  Attack/cookie.md"
click node_bypass403 "https://github.com/az0x7/vulnerability-checklist/blob/main/403 Bypass/403-bypass.md"
click node_idor "https://github.com/az0x7/vulnerability-checklist/blob/main/IDOR Vulnerability/idor.md"
click node_admin "https://github.com/az0x7/vulnerability-checklist/blob/main/Admin panal/adminpanal.md"
click node_csrf "https://github.com/az0x7/vulnerability-checklist/blob/main/CSRF/csrf.md"
click node_xss "https://github.com/az0x7/vulnerability-checklist/blob/main/RXSS/xss.md"
click node_mass "https://github.com/az0x7/vulnerability-checklist/blob/main/Mass Assignment/Mass.md"
click node_logic "https://github.com/az0x7/vulnerability-checklist/blob/main/Bussiness Logic/bussiness logic.md"
click node_json "https://github.com/az0x7/vulnerability-checklist/blob/main/Json Attack/json.md"
click node_upload "https://github.com/az0x7/vulnerability-checklist/blob/main/File Upload/File Upload.md"
click node_sql "https://github.com/az0x7/vulnerability-checklist/blob/main/Sql injection/sqlpayload.txt"
click node_rce "https://github.com/az0x7/vulnerability-checklist/blob/main/Rce/Rce.md"
click node_rate "https://github.com/az0x7/vulnerability-checklist/blob/main/Rate limit/bypass rate limit.md"
click node_exif "https://github.com/az0x7/vulnerability-checklist/blob/main/exif Vulnerability/exif_geo.md"
click node_aem "https://github.com/az0x7/vulnerability-checklist/blob/main/Aem misconfiguration/aem.md"
click node_django "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Django/Django.md"
click node_symfony "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Symfony/Symfony.md"
click node_django_yaml "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Django/exposing-django.yaml"
click node_symfony_t1 "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Symfony/template_1.yaml"
click node_symfony_t2 "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Symfony/template_2.yaml"
click node_symfony_t3 "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Symfony/template_3.yaml"
click node_symfony_t4 "https://github.com/az0x7/vulnerability-checklist/blob/main/Hacking Symfony/template_4.yaml"
click node_file_pdf1 "https://github.com/az0x7/vulnerability-checklist/blob/main/File Upload/File-Upload.pdf"
click node_file_pdf2 "https://github.com/az0x7/vulnerability-checklist/blob/main/File Upload/Slides(1).pdf"
click node_tips1 "https://github.com/az0x7/vulnerability-checklist/blob/main/tips from twitter /tips_twitter.md"
click node_tips2 "https://github.com/az0x7/vulnerability-checklist/blob/main/tips from twitter/tips_twitter_P2.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_readme toneBlue
class node_auth,node_api_auth,node_api_authz,node_twofa,node_ato,node_reset,node_register,node_cookie,node_bypass403,node_idor,node_admin toneAmber
class node_csrf,node_xss,node_mass,node_logic,node_json,node_upload,node_sql,node_rce,node_rate,node_exif,node_tips1,node_tips2 toneMint
class node_aem,node_django,node_symfony toneRose
class node_django_yaml,node_symfony_t1,node_symfony_t2,node_symfony_t3,node_symfony_t4,node_file_pdf1,node_file_pdf2 toneIndigo
```

## Components

### Index

Repository entry and navigation layer

- [README](https://github.com/az0x7/vulnerability-checklist/blob/main/README.md): index · Top-level topic index and navigation hub · `README.md`

### Access Control

Identity, session, and privilege-boundary checklists

- [Authentication](https://github.com/az0x7/vulnerability-checklist/blob/main/Authentication/authentication.md): checklist · Core authentication probing notes · `Authentication/authentication.md`
- [API Auth](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Api%20Authentication%20/Authentication.md): checklist · API authentication checks · `Api Authentication /Authentication.md`
- [API AuthZ](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Api%20Authorization/Authorization.md): checklist · API authorization checks · `Api Authorization/Authorization.md`
- [2FA Bypass](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/2FA%20Bypass/2FA%20bypass.md): checklist · Two-factor bypass techniques · `2FA Bypass/2FA bypass.md`
- [Account Takeover](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Acount%20takeover/ATO.md): checklist · Account takeover scenarios and validation · `Acount takeover/ATO.md`
- [Reset Password](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/reset%20password/reset_password_checklist.md): checklist · Password reset abuse checklist · `reset password/reset_password_checklist.md`
- [Register Vuln](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/register%20vulnerability/register.md): checklist · Registration flow abuse checks · `register vulnerability/register.md`
- [Cookie Attack](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Cookie%20Attack/cookie.md): checklist · Cookie and session manipulation notes · `Cookie Attack/cookie.md`
- [403 Bypass](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/403%20Bypass/403-bypass.md): checklist · Access-denial bypass techniques · `403 Bypass/403-bypass.md`
- [IDOR](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/IDOR%20Vulnerability/idor.md): checklist · Object reference and authorization gaps · `IDOR Vulnerability/idor.md`
- [Admin Panel](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Admin%20panal/adminpanal.md): checklist · Administrative surface discovery and abuse · `Admin panal/adminpanal.md`

### Web Exploits

General application-layer vulnerability checklists

- [CSRF](https://github.com/az0x7/vulnerability-checklist/blob/main/CSRF/csrf.md): checklist · Cross-site request forgery checks · `CSRF/csrf.md`
- [RXSS](https://github.com/az0x7/vulnerability-checklist/blob/main/RXSS/xss.md): checklist · Reflected XSS checklist · `RXSS/xss.md`
- [Mass Assignment](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Mass%20Assignment/Mass.md): checklist · Field overposting and binding issues · `Mass Assignment/Mass.md`
- [Business Logic](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Bussiness%20Logic/bussiness%20logic.md): checklist · Workflow abuse and logic flaws · `Bussiness Logic/bussiness logic.md`
- [JSON Attack](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Json%20Attack/json.md): checklist · JSON parsing and request-shape abuse · `Json Attack/json.md`
- [File Upload](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/File%20Upload/File%20Upload.md): checklist · Upload validation and execution checks · `File Upload/File Upload.md`
- [SQL Injection](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Sql%20injection/sqlpayload.txt): checklist · SQLi payload and validation notes · `Sql injection/sqlpayload.txt`
- [RCE](https://github.com/az0x7/vulnerability-checklist/blob/main/Rce/Rce.md): checklist · Remote code execution probing notes · `Rce/Rce.md`
- [Rate Limit](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Rate%20limit/bypass%20rate%20limit.md): checklist · Rate-limit bypass techniques · `Rate limit/bypass rate limit.md`
- [EXIF Geo](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/exif%20Vulnerability/exif_geo.md): checklist · Metadata and geolocation leakage checks · `exif Vulnerability/exif_geo.md`
- [Tips P1](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/tips%20from%20twitter%20/tips_twitter.md): notes · Supplementary tips and observations · `tips from twitter /tips_twitter.md`
- [Tips P2](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/tips%20from%20twitter/tips_twitter_P2.md): notes · Supplementary tips and observations · `tips from twitter/tips_twitter_P2.md`

### Framework Playbooks

Framework-specific testing guides and templates

- [AEM Misconfig](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Aem%20misconfiguration/aem.md): checklist · Platform misconfiguration notes · `Aem misconfiguration/aem.md`
- [Django](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Django/Django.md): playbook · Framework-specific Django attack playbook · `Hacking Django/Django.md`
- [Symfony](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/Symfony.md): playbook · Framework-specific Symfony attack playbook · `Hacking Symfony/Symfony.md`

### Artifacts

Reusable payloads and supporting reference files

- [Django YAML](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Django/exposing-django.yaml): template · Django-oriented YAML template · `Hacking Django/exposing-django.yaml`
- [Symf T1](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/template_1.yaml): template · Symfony template 1 · `Hacking Symfony/template_1.yaml`
- [Symf T2](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/template_2.yaml): template · Symfony template 2 · `Hacking Symfony/template_2.yaml`
- [Symf T3](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/template_3.yaml): template · Symfony template 3 · `Hacking Symfony/template_3.yaml`
- [Symf T4](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/Hacking%20Symfony/template_4.yaml): template · Symfony template 4 · `Hacking Symfony/template_4.yaml`
- [Upload PDF](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/File%20Upload/File-Upload.pdf): reference · File upload reference PDF · `File Upload/File-Upload.pdf`
- [Upload Slides](https://github.com/az0x7/vulnerability-checklist/blob/HEAD/File%20Upload/Slides(1).pdf): reference · Additional upload-related slide deck · `File Upload/Slides(1).pdf`

## Connections

- README → Authentication: indexes · README points to the main authentication checklist
- README → API Auth: indexes · README points to API authentication guidance
- README → API AuthZ: indexes · README points to API authorization guidance
- README → 2FA Bypass: indexes · README points to two-factor bypass notes
- README → Account Takeover: indexes · README points to account takeover notes
- README → Reset Password: indexes · README points to reset-password abuse checks
- README → Register Vuln: indexes · README points to registration abuse checks
- README → IDOR: indexes · README points to IDOR coverage
- README → Admin Panel: indexes · README points to admin-panel checks
- README → CSRF: indexes · README points to CSRF coverage
- README → RXSS: indexes · README points to XSS coverage
- README → Mass Assignment: indexes · README points to mass-assignment checks
- README → Business Logic: indexes · README points to business-logic checks
- README → File Upload: indexes · README points to file-upload guidance
- README → SQL Injection: indexes · README points to SQL injection payloads
- README → RCE: indexes · README points to RCE notes
- README → Rate Limit: indexes · README points to rate-limit bypass notes
- README → Django: indexes · README points to Django playbook
- README → Symfony: indexes · README points to Symfony playbook
- README → AEM Misconfig: indexes · README points to AEM misconfiguration notes
- Authentication → API Auth: relates · Authentication flows connect to API auth
- Authentication → API AuthZ: relates · Authentication boundaries feed authorization checks
- Authentication → 2FA Bypass: relates · Authentication includes second-factor bypass paths
- Authentication → Account Takeover: relates · Authentication weaknesses can enable takeover
- Account Takeover → Reset Password: adjacent · Account takeover overlaps with reset flows
- Account Takeover → Register Vuln: adjacent · Account takeover overlaps with registration abuse
- API AuthZ → IDOR: adjacent · Authorization issues commonly manifest as IDOR
- Cookie Attack → Authentication: supports · Cookie handling supports session/auth testing
- 403 Bypass → API AuthZ: supports · 403 bypasses are a form of authorization failure
- CSRF → Cookie Attack: depends on · CSRF testing often involves session cookie behavior
- Business Logic → Rate Limit: adjacent · Business logic issues often intersect with throttling
- File Upload → RCE: enables · Unsafe uploads can lead to code execution
- File Upload → Upload PDF: references · Upload checklist is backed by PDF material
- File Upload → Upload Slides: references · Upload checklist has additional slide reference
- SQL Injection → JSON Attack: adjacent · Request-shape manipulation can affect SQL injection testing
- Django → Django YAML: uses · Django playbook is paired with a YAML template
- Symfony → Symf T1: uses · Symfony playbook is paired with template 1
- Symfony → Symf T2: uses · Symfony playbook is paired with template 2
- Symfony → Symf T3: uses · Symfony playbook is paired with template 3
- Symfony → Symf T4: uses · Symfony playbook is paired with template 4
- README → Tips P1: indexes · README-adjacent supplementary notes
- Tips P1 → Tips P2: continues · Supplementary notes continue across two parts