Web Security
From HTTP basics to advanced exploitation. Master every OWASP vulnerability, Burp Suite, API attacks, JWT/OAuth, SSRF, SSTI, and modern web exploitation techniques.
Start Here — Foundations — no experience assumed
Burp Suite Basics
Intercept, modify, and replay HTTP requests using Burp Suite Community Edition.
Command Injection
OS command injection via semicolons, pipes, and backticks with filter bypass.
Cross-Site Scripting (XSS)
Reflected, stored, and DOM-based XSS with cookie theft and keylogger payloads.
HTML & CSS Basics
HTML structure, CSS, forms, and JavaScript basics for web security context.
Insecure Direct Object References (IDOR)
IDOR via predictable IDs, GUIDs, and horizontal vs vertical privilege escalation.
Introduction to Web Applications
Client-server model, web technologies, cookies, sessions, and same-origin policy.
SQL Injection Deep Dive
Error-based, union-based, and basic SQLi with manual exploitation.
Web Application Recon
Directory busting, technology fingerprinting, and web attack surface mapping.
Web Fuzzing & Directory Brute Forcing
Fast directory, parameter, and vhost fuzzing with ffuf and SecLists.
Build Your Skills — Intermediate — hands-on
Advanced SQL Injection
Second-order SQLi, stored procedures, and WAF bypass techniques.
Advanced XSS & CSRF
XSS chaining, CSP bypass, CSRF token theft, and SameSite attribute bypass.
Attacking Authentication Mechanisms
2FA bypass, brute force protection bypass, and credential stuffing.
Blind SQL Injection
Boolean-based and time-based blind SQLi with sqlmap and manual methods.
Broken Authentication & Sessions
Session fixation, prediction, and authentication logic flaws.
File Upload Vulnerabilities
Bypass extension filters, MIME type checks, and upload webshells.
Injection Attacks: XPath, LDAP & HTML-to-PDF
Exploit XML XPath and LDAP directory injection vulnerabilities.
Local & Remote File Inclusion
Path traversal, null byte injection, PHP wrappers, and remote file inclusion.
NoSQL Injection
MongoDB operator injection, authentication bypass, and data extraction.
OAuth & JWT Attacks
alg:none bypass, RS256→HS256 confusion, JWT cracking, and OAuth code theft.
Server-Side Template Injection (SSTI)
Detect and exploit Jinja2, Twig, and Freemarker SSTI for RCE.
SQL Injection Fundamentals
In-band, blind, and out-of-band SQLi with manual and automated exploitation.
SSRF Attacks
Internal service access, cloud metadata exploitation, and SSRF filter bypasses.
Subdomain Takeover
Enumerate dangling DNS, claim GitHub Pages and S3 buckets, exploit cookie scope.
Web Application Pentesting
OWASP Top 10, Burp Suite advanced usage, and web pentest methodology.
Web Attacks: IDOR, XXE & Verb Tampering
XXE external entity injection, blind XXE via OOB, and mass IDOR testing.
WordPress Exploitation
WPScan, plugin CVEs, theme RCE, XML-RPC abuse, and brute force.
Go Advanced — Advanced — for practitioners
API & Web Service Attacks
REST API enumeration, BOLA, mass assignment, and API-specific fuzzing.
Attacking GraphQL
Introspection abuse, batching attacks, and GraphQL injection.
Bug Bounty Hunting
HackerOne/Bugcrowd methodology, triaging, report writing, and maximising payouts.
HTTP Misconfiguration Abuse
CORS, caching, host header injection, and HTTP/2 downgrade attacks.
HTTP Request Smuggling
CL.TE and TE.CL desync attacks to bypass front-end security controls.
Insecure Deserialization
Java, PHP, and Python deserialization gadget chains for RCE.
JavaScript Deobfuscation
Unpack obfuscated JS, extract hidden endpoints, and reverse client-side logic.
Modern Web Exploitation
Prototype pollution, web cache poisoning, and client-side path traversal.
Server-Side Request Forgery & Attacks
Advanced SSRF chains, XXE, and server-side prototype pollution.
White-Box Web Exploitation: Auth Bypass to RCE
Code review-driven RCE finding in PHP, Python, and Java web applications.