How the Web Really Works (Attacker View)

The request/response game

Every web attack is, at its core, a crafted HTTP request. The browser is just a convenient client — a pentester replaces it with a proxy and sends exactly the bytes they want. If you understand requests, headers, cookies, and how the server turns them into database queries, file reads, and OS calls, you understand where things break.

The OWASP Top 10

The OWASP Top 10 is the industry's list of the most critical web risks: broken access control, injection, cryptographic failures, insecure design, security misconfiguration, and more. This course is built around attacking and then fixing each of them on real, intentionally vulnerable targets.

• Client vs server trust — anything the browser sends can be forged. Never trust it.
• Input → sink — vulnerabilities happen when attacker input reaches a dangerous "sink" (a DB query, HTML, a shell) without proper handling.
• Defense in depth — every attack in this course has a concrete fix you must be able to explain.

⚖️ For authorized, legal testing only — attack only the lab targets or systems you own.

What's in Web Application Security

• 1. How the Web Really Works (Attacker View)Free
• 2. Mapping the Attack Surface🔒 Recon
• 3. SQL Injection🔒 Injection
• 4. Cross-Site Scripting (XSS)🔒 Client-Side
• 5. Cross-Site Request Forgery (CSRF)🔒 Client-Side
• 6. Broken Access Control & IDOR🔒 Access Control
• 7. Authentication & Session Testing🔒 Auth
• 8. Server-Side Request Forgery (SSRF)🔒 Server-Side
• 9. Path Traversal & File Inclusion🔒 Server-Side
• 10. Command Injection & Race Conditions🔒 Server-Side
• 11. File Upload Vulnerabilities🔒 Core
• 12. Session Attacks — Hijacking & Fixation🔒 Core
• 13. Reporting, Fixes & Certification Exam🔒 Exam

Continue in the interactive course reader →