1. SQL Injection:

Exploiting vulnerabilities in a website's database layer by injecting malicious SQL queries to manipulate or retrieve data.

2. Cross-Site Scripting (XSS):

Injecting malicious scripts into web pages viewed by other users, which can then execute in their browsers and steal information or perform actions on their behalf.

3. Cross-Site Request Forgery (CSRF):

Trick a user into performing actions on a website without their consent by exploiting the trust that the site has in the user's browser.

4. File Inclusion:

Including files on a server through a web browser, which can lead to code execution and data breaches. This includes Local File Inclusion (LFI) and Remote File Inclusion (RFI).

5. Directory Traversal:

Accessing restricted directories and executing commands outside of the web server's root directory by manipulating file paths.

6. Authentication and Session Hijacking:

Stealing or manipulating session tokens to gain unauthorized access to user accounts.

7. Denial of Service (DoS):

Overwhelming a web server with traffic to make it unavailable to users.

8. Man-in-the-Middle (MitM) Attacks:

Intercepting and potentially altering communications between the user's browser and the web server.

9. Phishing:

Creating fake websites that appear legitimate to trick users into entering sensitive information.

These activities can be performed by malicious hackers with the intent to cause harm, steal data, or disrupt services. However, ethical hackers (or penetration testers) may also perform these techniques in a controlled and authorized manner to identify and fix vulnerabilities, improving the security of web applications.