My notes on web security and web exploitation, from HTTP and the tooling through the classic vulnerability classes (injection, XSS, authentication, access control, SSRF, file and path, template and deserialization, API), then chaining bugs together and real practice. Each lesson pairs the theory with a tool demo and a self-contained lab you can run.

Everything here is for learning, CTFs, authorized testing and bug bounty within scope. The labs are deliberately vulnerable apps that run on your own machine. Do not attack systems you do not have permission to test.

Web · Intro to Web Hacking

#	Lesson
0.1	What Web Hacking Is, Attack Surface and Ethics
0.2	HTTP and HTTPS Methods, Headers, Status Codes and Cookies
0.3	Web Architecture, Same-Origin Policy and Cookie Attributes
0.4	Building a Web Lab with Burp Suite and Docker

Web · Tools and Recon

#	Lesson
1.1	Burp Suite core modules
1.2	DevTools, curl and httpie
1.3	Recon and content discovery
1.4	Fingerprinting web technologies

Web · Injection

#	Lesson
2.1	Basic SQL Injection with UNION and Error-Based
2.2	Blind SQL Injection with Boolean and Time
2.3	sqlmap and WAF Bypass with Tamper Scripts
2.4	NoSQL Injection and Auth Bypass in MongoDB
2.5	Command Injection, In-Band and Blind

Web · Cross-Site Scripting

#	Lesson
3.1	Reflected XSS and Choosing Payloads by Context
3.2	Stored XSS and Its Lasting Impact
3.3	DOM-based XSS from Source to Sink
3.4	Bypassing Filters and CSP
3.5	Exploiting XSS from Cookie Theft to Account Takeover

Web · Authentication and Session

#	Lesson
4.1	Authentication flaws, brute force, and default credentials
4.2	Session management, fixation, and guessable tokens
4.3	Attacking JWT with alg none and weak secrets
4.4	OAuth2 and SSO, redirect_uri and state attacks
4.5	Password reset and MFA bypass

Web · Access Control

#	Lesson
5.1	IDOR and unchecked object references
5.2	Broken access control and privilege escalation
5.3	CSRF, tokens and SameSite cookies
5.4	Mass assignment and parameter tampering

Web · SSRF and Request-Side

#	Lesson
6.1	Basic SSRF and Reaching Internal Services
6.2	Bypassing SSRF Filters
6.3	Open Redirect and Its Abuse
6.4	HTTP Request Smuggling with CL.TE and TE.CL

Web · File and Path

#	Lesson
7.1	Path Traversal and LFI
7.2	File Upload to RCE
7.3	Escalating LFI to RCE

Web · Template and Deserialization

#	Lesson
8.1	Server-Side Template Injection
8.2	Insecure Deserialization
8.3	XML External Entity Injection

Web · API and Modern Web

#	Lesson
9.1	REST API Security, BOLA and BFLA
9.2	GraphQL Introspection and Query Abuse
9.3	CORS Misconfiguration and Its Consequences
9.4	Prototype Pollution in Node.js

Web · Chaining

#	Lesson
10.1	Chaining recon to RCE
10.2	Client-side chaining from XSS to account takeover

Web · Hands-on

#	Lesson
11.1	Solving PortSwigger Web Security Academy Labs by Topic
11.2	Writing a Web CTF Writeup
11.3	Auditing a Web App and Writing the Report