# Web And AI Attack Map

Use the fused upstream material for complete content:

- `references/`
- `references/web-playbook-*.md`
- `references/tools-reference-*.md`

## Web Families

- SQL and NoSQL injection
- XSS
- SSRF
- RCE
- XXE
- SSTI
- LFI and RFI
- CSRF
- JWT and auth flaws
- API and business logic flaws
- request smuggling
- cache and CDN issues
- WebSocket issues

## AI And MCP Families

- prompt injection
- indirect prompt injection
- CoT interference
- MCP tool poisoning
- hidden instruction injection
- agent privilege abuse
- prompt leakage


