Some interesting reading I've been doing for my new job with SPIDyanmics (Decius: SPEEEEEEEEEEEEEEE!!!!!). XSS, URL Encoding, and other typical web application hacking stuff. I was familiar with these attacks, but spent most of my time with my head in the layer 3/4 sand to investigate their full scope.

Web Application Security White Papers