Academy
All topics
Every topic and every lesson in the Academy, one page, nothing hidden. 14 topics carry 48 lessons between them; the labs and quizzes walk with their parent text.
Topics 14
Authentication Flaws
Spraying, lockouts, and reset tokens: where login logic breaks.
Broken Access Control
IDOR and missing checks: asking for someone else's objects by number.
Cross-Site Request Forgery
Ride the victim's session: why ambient authority needs tokens.
Cross-Site Scripting
Reflected, stored, DOM: where input becomes script, and how encoding stops it.
Defensive Foundations
Triage, hunt, detect, and respond with evidence you can defend.
HTTP Request Smuggling
Two servers, two framings, one hidden request in the gap.
JWT Attacks
Trusting tokens: alg confusion, none, and weak secrets.
Offensive Foundations
Think like a tester: scope, recon, probing, and reporting that holds up.
OS Command Injection
When user input reaches a shell: separators, exfiltration, and the fix.
Path Traversal
Dot-dot-slash past the intended directory, and the allowlists that stop it.
Prototype Pollution
Merging __proto__ poisons every object. Guard the keys.
Server-Side Request Forgery
Make the server fetch for you: internal services, metadata, and egress control.
Server-Side Template Injection
When your words become the template's code.
SQL Injection
Break out of the query, read what you should not, then fix it with parameters.
Every lesson, A to Z 48
- Access control quizBroken Access ControlApprentice · quiz · 6 min
- Authentication quizAuthentication FlawsPractitioner · quiz · 6 min
- Command injection quizOS Command InjectionPractitioner · quiz · 6 min
- Contain, then fixDefensive Foundationsread · 18 min
- CSRF quizCross-Site Request ForgeryApprentice · quiz · 6 min
- Hardening that mattersDefensive Foundationsquiz · 18 min
- How broken access control worksBroken Access ControlApprentice · read · 10 min
- How command injection worksOS Command InjectionApprentice · read · 12 min
- How CSRF worksCross-Site Request ForgeryApprentice · read · 10 min
- How JWTs breakJWT AttacksPractitioner · read · 12 min
- How logins breakAuthentication FlawsApprentice · read · 12 min
- How path traversal worksPath TraversalApprentice · read · 10 min
- How prototype pollution worksPrototype PollutionPractitioner · read · 12 min
- How request smuggling worksHTTP Request SmugglingPractitioner · read · 15 min
- How SQL injection worksSQL InjectionApprentice · read · 12 min
- How SSRF worksServer-Side Request ForgeryApprentice · read · 12 min
- How SSTI worksServer-Side Template InjectionPractitioner · read · 12 min
- How XSS worksCross-Site ScriptingApprentice · read · 12 min
- Hunting in logsDefensive Foundationslab · 25 min
- Indicators of compromiseDefensive Foundationsquiz · 18 min
- JWT quizJWT AttacksExpert · quiz · 6 min
- Lab: hide a requestHTTP Request SmugglingExpert · lab · 20 min
- Lab: login bypassSQL InjectionApprentice · lab · 15 min
- Lab: out of the pages directoryPath TraversalApprentice · lab · 12 min
- Lab: poison the prototypePrototype PollutionPractitioner · lab · 15 min
- Lab: reflected greetingCross-Site ScriptingApprentice · lab · 15 min
- Lab: somebody else's orderBroken Access ControlApprentice · lab · 12 min
- Lab: the greeting that calculatesServer-Side Template InjectionPractitioner · lab · 15 min
- Lab: the helpful fetcherServer-Side Request ForgeryPractitioner · lab · 15 min
- Lab: the helpful ping boxOS Command InjectionPractitioner · lab · 15 min
- Lab: the missing tokenCross-Site Request ForgeryApprentice · lab · 12 min
- Lab: the unsigned adminJWT AttacksPractitioner · lab · 15 min
- Lab: under the lockout radarAuthentication FlawsPractitioner · lab · 15 min
- Passive reconOffensive Foundationslab · 25 min
- Passwords under attackOffensive Foundationsread · 18 min
- Path traversal quizPath TraversalApprentice · quiz · 6 min
- Prototype pollution quizPrototype PollutionExpert · quiz · 6 min
- Reading HTTPOffensive Foundationsquiz · 18 min
- Report like a professionalOffensive Foundationsquiz · 18 min
- Request smuggling quizHTTP Request SmugglingExpert · quiz · 6 min
- SQL injection quizSQL InjectionPractitioner · quiz · 6 min
- SSRF quizServer-Side Request ForgeryPractitioner · quiz · 6 min
- SSTI quizServer-Side Template InjectionPractitioner · quiz · 6 min
- The triage mindsetDefensive Foundationsread · 15 min
- Think like a testerOffensive Foundationsread · 15 min
- XSS quizCross-Site ScriptingPractitioner · quiz · 6 min
- Your first detectionDefensive Foundationslab · 25 min
- Your first probeOffensive Foundationslab · 25 min
Lesson pages open for prospective learners; progress, exams and certificates need a free account.