The thing that I find difficult with OWASP: there doesn't always seem to be comprehensive examples provided for what these attack surfaces could be used for. That makes it difficult to both understand the impact of a particular issue, and test for it.

As an example: https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security...

I'm fascinated to know how this could actually be exploited. But there's no hint or reference to that. It's just "don't do this".