New lab: 0.CL request smuggling

Learn how to exploit subtle inconsistencies in HTTP request parsing using the powerful 0.CL request smuggling technique. This lab is based on HTTP/1 Must Die, cutting-edge research from PortSwigger presented at Black Hat USA 2025.

Learn more

Welcome!

Learn to secure the web one step at a time, with our practical, interactive learning materials. Covering the latest research, and completely free.

Your learning progress

Share your progress on Twitter

Ready for your next challenge?

Jump straight into the latest topic releases, or check out our full topics list.

Learning paths

Guided learning paths through the Web Security Academy

Can we help you get started?

Let us help you get the most out of your Academy experience: we've broken down how it all works, and created a recommended list of topics for you to start with.

Getting started guide

Burp AI

Your on-demand AI testing partner

Cut through repetitive tasks, validate findings faster, and get expert agentic AI insight - so you can spend more time chasing the bugs that matter. Your skills, your control; just faster, sharper, smarter.

Learn more

Want the latest from the Web Security Academy?

Learning about web security @WebSecAcademy and don't know how I made it this long in the web design world without getting into this. Now I am hooked. Can't stop playing around in their labs. Just spent an entire long weekend in front of the laptop #websec #100DaysOfCode

@CodeWithFrida

New lab: 0.CL request smuggling

Welcome!

Your learning progress

Share your progress on Twitter

Ready for your next challenge?

Web cache deception

Web LLM attacks

API testing

NoSQL injection