Research Academy
My account Customers About Blog Careers Legal Contact Resellers
  1. Web Security Academy
  2. All materials

All learning materials

See detailed view

Web Security Academy
Put your recon skills to the test
Getting started with the Web Security Academy
What is prototype pollution?
     JavaScript prototypes and inheritance
     Client-side prototype pollution vulnerabilities
          Prototype pollution via browser APIs
     Server-side prototype pollution
     Preventing prototype pollution vulnerabilities
Essential skills
     Obfuscating attacks using encodings
     Using Burp Scanner during manual testing
JWT attacks
     Algorithm confusion attacks
SQL injection
     SQL injection UNION attacks
     Examining the database in SQL injection attacks
     Blind SQL injection
     SQL injection cheat sheet
Cross-site scripting
     Reflected XSS
     Cross-site scripting (XSS) cheat sheet
     Stored XSS
     DOM-based XSS
     Exploiting cross-site scripting vulnerabilities
     Cross-site scripting contexts
          Client-side template injection
     Content security policy
     Dangling markup injection
     How to prevent XSS
Cross-site request forgery (CSRF)
     XSS vs CSRF
     Bypassing CSRF token validation
     Bypassing SameSite cookie restrictions
     Bypassing Referer-based CSRF defenses
     How to prevent CSRF vulnerabilities
XML external entity (XXE) injection
     XML entities
     Finding and exploiting blind XXE vulnerabilities
Clickjacking (UI redressing)
Cross-origin resource sharing (CORS)
     Same-origin policy (SOP)
     CORS and the Access-Control-Allow-Origin response header
Server-side request forgery (SSRF)
     Blind SSRF vulnerabilities
HTTP request smuggling
     Finding HTTP request smuggling vulnerabilities
     Exploiting HTTP request smuggling vulnerabilities
     Advanced request smuggling
          Response queue poisoning
          HTTP request tunnelling
          HTTP/2 downgrading
          HTTP/2-exclusive vectors
     Browser-powered request smuggling
          CL.0 request smuggling
          Client-side desync attacks
          Pause-based desync attacks
OS command injection
Server-side template injection
     Exploiting server-side template injection vulnerabilities
Insecure deserialization
     Exploiting insecure deserialization vulnerabilities
Directory traversal
Access control vulnerabilities and privilege escalation
     Access control security models
     Insecure direct object references (IDOR)
Authentication vulnerabilities
     Vulnerabilities in password-based login
     Vulnerabilities in multi-factor authentication
     Vulnerabilities in other authentication mechanisms
     Authentication lab usernames
     Authentication lab passwords
     How to secure your authentication mechanisms
OAuth 2.0 authentication vulnerabilities
     How to prevent OAuth authentication vulnerabilities
     OAuth grant types
     OpenID Connect
Business logic vulnerabilities
     Examples of business logic vulnerabilities
Testing for WebSockets security vulnerabilities
     What are WebSockets?
     Cross-site WebSocket hijacking
DOM-based vulnerabilities
     Controlling the web message source
     DOM-based open redirection
     DOM-based cookie manipulation
     DOM-based JavaScript injection
     DOM-based document-domain manipulation
     DOM-based WebSocket-URL poisoning
     DOM-based link manipulation
     Web message manipulation
     DOM-based Ajax request-header manipulation
     DOM-based local file-path manipulation
     DOM-based client-side SQL injection
     DOM-based HTML5-storage manipulation
     DOM-based client-side XPath injection
     DOM-based client-side JSON injection
     DOM-data manipulation
     DOM-based denial of service
     DOM clobbering
Web cache poisoning
     Exploiting cache design flaws
     Exploiting cache implementation flaws
HTTP Host header attacks
     How to identify and exploit HTTP Host header vulnerabilities
          Password reset poisoning
Information disclosure vulnerabilities
     How to find and exploit information disclosure vulnerabilities
File upload vulnerabilities
Guidelines for submitting video solutions
Who is behind the Web Security Academy?
Welcome back!