Web Security 46
- Lesson 11.3: Auditing a Web App and Writing the Report
- Lesson 11.2: Writing a Web CTF Writeup
- Lesson 11.1: Solving PortSwigger Web Security Academy Labs by Topic
- Lesson 10.2: Client-side chaining from XSS to account takeover
- Lesson 10.1: Chaining recon to RCE
- Lesson 9.4: Prototype Pollution in Node.js
- Lesson 9.3: CORS Misconfiguration and Its Consequences
- Lesson 9.2: GraphQL Introspection and Query Abuse
- Lesson 9.1: REST API Security, BOLA and BFLA
- Lesson 8.3: XML External Entity Injection
- Lesson 8.2: Insecure Deserialization
- Lesson 8.1: Server-Side Template Injection
- Lesson 7.3: Escalating LFI to RCE
- Lesson 7.2: File Upload to RCE
- Lesson 7.1: Path Traversal and LFI
- Lesson 6.4: HTTP Request Smuggling with CL.TE and TE.CL
- Lesson 6.3: Open Redirect and Its Abuse
- Lesson 6.2: Bypassing SSRF Filters
- Lesson 6.1: Basic SSRF and Reaching Internal Services
- Lesson 5.4: Mass assignment and parameter tampering
- Lesson 5.3: CSRF, tokens and SameSite cookies
- Lesson 5.2: Broken access control and privilege escalation
- Lesson 5.1: IDOR and unchecked object references
- Lesson 4.5: Password reset and MFA bypass
- Lesson 4.4: OAuth2 and SSO, redirect_uri and state attacks
- Lesson 4.3: Attacking JWT with alg none and weak secrets
- Lesson 4.2: Session management, fixation, and guessable tokens
- Lesson 4.1: Authentication flaws, brute force, and default credentials
- Lesson 3.5: Exploiting XSS from Cookie Theft to Account Takeover
- Lesson 3.4: Bypassing Filters and CSP
- Lesson 3.3: DOM-based XSS from Source to Sink
- Lesson 3.2: Stored XSS and Its Lasting Impact
- Lesson 3.1: Reflected XSS and Choosing Payloads by Context
- Lesson 2.5: Command Injection, In-Band and Blind
- Lesson 2.4: NoSQL Injection and Auth Bypass in MongoDB
- Lesson 2.3: sqlmap and WAF Bypass with Tamper Scripts
- Lesson 2.2: Blind SQL Injection with Boolean and Time
- Lesson 2.1: Basic SQL Injection with UNION and Error-Based
- Lesson 1.4: Fingerprinting web technologies
- Lesson 1.3: Recon and content discovery
- Lesson 1.2: DevTools, curl and httpie
- Lesson 1.1: Burp Suite core modules
- Lesson 0.4: Building a Web Lab with Burp Suite and Docker
- Lesson 0.3: Web Architecture, Same-Origin Policy and Cookie Attributes
- Lesson 0.2: HTTP and HTTPS Methods, Headers, Status Codes and Cookies
- Lesson 0.1: What Web Hacking Is, Attack Surface and Ethics