threatfound
All paths
Beginner · 5 modules

Web Application Security

The bread and butter, how web apps break, from HTTP basics to XSS, SQLi and access control.

▸ the territory
5 / 5 live

A map, not a checklist, see exactly where you are and what comes next.

  1. HTTP, the language of…8m
  2. ✓Cross-Site Scripting…10m
  3. ✓SQL Injection11m
  4. ✓Broken Access Control…9m
  5. ✓Server-Side Request F…10m

Lessons

read · then do
01HTTP, the language of the webRequests, responses, methods, status codes and headers, the foundation every web attack builds on. 8 min read
02Cross-Site Scripting (XSS)How attacker-controlled input becomes executable JavaScript in a victim’s browser, and how to prove it. 10 min read
03SQL InjectionWhen user input is concatenated into a query, an attacker can rewrite the query itself, reading or destroying the database. 11 min read
04Broken Access Control & IDORWhen the app forgets to check who you are, the #1 category on the OWASP Top 10. 9 min read
05Server-Side Request Forgery (SSRF)Make the server make requests for you, into the cloud metadata service and internal network. 10 min read
Start the first lesson