From HTTP basics and assessment prep, through authentication and sessions, injection (SQLi), client-side issues like XSS and CSRF, access-control and logic flaws, to APIs. In 30 lessons you learn why the common web vulnerabilities arise, how to find them, and how to fix them. Every example and exercise targets only the fictional "Sample Corp." and your own local lab.
The 30 lessons are split into 6 chapters. Working through them in order is recommended, but you can also dip into just the parts you need. * Attack examples exist to understand how vulnerabilities work and how to fix them. Only try them against a practice environment you set up yourself or the consented labs on the security track.
Web assessment starts from confirming authorization and reading HTTP. This chapter covers prep, HTTP basics, observing with a proxy, and grasping the whole app.
Verifying "who you are" and keeping that state is where web weaknesses gather. This chapter covers authentication, sessions, password storage, and the basics of MFA and authorization.
Processing user input while trusting it breeds injection. This chapter covers the principles of input validation, and injection into SQL, commands and templates, and how to close them.
Problems that happen on the browser side directly affect users. This chapter covers XSS, CSRF, CORS and security headers, from both mechanism and defense.
Flaws that let you do "what should be impossible" are hard to find with tools. This chapter covers access-control flaws, file upload, and business-logic flaws.
APIs are the center of the modern web and have their own caveats. This chapter covers API assessment, tokens and JWT, and rate limiting, closing with recording findings and handoff.
After the 30 lessons, head to the Access-Control Weaknesses course. How to communicate what you found so the other side can fix it is in the report-writing course. Membership unlocks every course.