Academy
Learning paths
Curated routes through the Academy, each ending in a timed exam and a verifiable certificate. Paths are built from the tracks that exist today — when the library grows, the paths grow with it. Every individual topic (and its lessons) remains open to you in any order beyond the path gates.
Security foundations
Start here if you have never shipped a finding. Walk an engagement end to end — scoping, recon, probing HTTP, credentials, reporting — then flip to the defender's chair and build the same instincts from the other side of the log.
- 01
Offensive Foundations
Think like a tester: scope, recon, probing, and reporting that holds up.
6 lessons · 2 labs · ~119 min · Beginner
- 02
Defensive Foundations
Triage, hunt, detect, and respond with evidence you can defend.
6 lessons · 2 labs · ~119 min · Beginner
Web exploitation library
The topic library: individual flaws, each with its own reading, a browser lab, and a certificate gate. Take them in any order, but the catalog is written to build — access control before SSRF, traversal before templates.
- 01
SQL Injection
Break out of the query, read what you should not, then fix it with parameters.
3 lessons · 1 lab · ~33 min · Practitioner
- 02
Cross-Site Scripting
Reflected, stored, DOM: where input becomes script, and how encoding stops it.
3 lessons · 1 lab · ~33 min · Practitioner
- 03
Cross-Site Request Forgery
Ride the victim's session: why ambient authority needs tokens.
3 lessons · 1 lab · ~28 min · Apprentice
- 04
OS Command Injection
When user input reaches a shell: separators, exfiltration, and the fix.
3 lessons · 1 lab · ~33 min · Practitioner
- 05
Server-Side Request Forgery
Make the server fetch for you: internal services, metadata, and egress control.
3 lessons · 1 lab · ~33 min · Practitioner
- 06
Path Traversal
Dot-dot-slash past the intended directory, and the allowlists that stop it.
3 lessons · 1 lab · ~28 min · Apprentice
- 07
Broken Access Control
IDOR and missing checks: asking for someone else's objects by number.
3 lessons · 1 lab · ~28 min · Apprentice
- 08
Authentication Flaws
Spraying, lockouts, and reset tokens: where login logic breaks.
3 lessons · 1 lab · ~33 min · Practitioner
Expert techniques
Where the easy checklists end: request smuggling, template injection, JWT games, prototype pollution. These topics assume fluent HTTP and reward already having broken things before.
- 01
HTTP Request Smuggling
Two servers, two framings, one hidden request in the gap.
3 lessons · 1 lab · ~41 min · Expert
- 02
Server-Side Template Injection
When your words become the template's code.
3 lessons · 1 lab · ~33 min · Expert
- 03
JWT Attacks
Trusting tokens: alg confusion, none, and weak secrets.
3 lessons · 1 lab · ~33 min · Expert
- 04
Prototype Pollution
Merging __proto__ poisons every object. Guard the keys.
3 lessons · 1 lab · ~33 min · Expert