Web Security Learning Path: HTTP, Sessions, SQLi and XSS
YOUR LEARNING PATH
Understand how requests and responses travel, how applications keep login state, and where input crosses a trust boundary. Organize each lab around its cause, the evidence you observed and the corresponding defense.
Who is this path for?
Learners with basic web and networking knowledge who are preparing for web security labs or wargames
Before you begin
Review HTML, JavaScript, HTTP and basic programming first. Perform security exercises in your own local lab or the learning platform authorized in the lesson.
What you will practice
- Explain HTTP requests and responses, cookies and sessions.
- Observe how input processing differs from authentication and access control.
- Record SQLi and XSS practice in terms of cause, evidence and defense.
STEP BY STEP
Your suggested lesson order
Understand web structure and requests
- 071 HTML/CSS Basics — A Web Page's Skeleton and ClothesStarting from an empty file, build by hand a web page with a title, paragraphs, links, images, lists, and inpu…
- 072 JavaScript Basics — The Language That Brings Web Pages to LifeWrite basic JS syntax compared with Python (let/const, function, console.log)
- 073 Understanding HTTP Completely — The Web's Rules of ConversationLaunch a practice web server on your computer with python -m http.server
- 074 The requests Library — Talking to the Web with PythonBuild your own practice server (lab.py) in Python that understands POST and cookies
- 075 Crawling with BeautifulSoup — Pulling Only What You Want from HTMLTurn an HTML string into a navigable structure with BeautifulSoup(string, "html.parser")
- 076 Crawlers and Automation — A Collector That Works by Itself Every DayLaunch the practice site on loopback.
Inspect requests and learn state management
- 131 Build Your Own Web Server — Login and SessionsCreate accounts in a sqlite3 DB and implement login verification
- 132 Burp Suite 1: Intercepting with a Proxy — Slipping Between Browser and ServerExplain what a proxy does between a browser and a server
- 133 Burp Suite 2: Repeater and Intruder — The Repeat Experiment Bench and the Automatic Machine GunSend a caught request to Repeater and run repeated experiments
- 134 Cookie and Session Attacks — Shaking the ID Card the Server TrustsExplain the structure by which cookies and sessions maintain login state, at the request/response header level
Practice vulnerabilities and access control
- 135 DVWA Setup and SQLi Basics — Crossing Low and MediumLaunch DVWA with Docker and adjust its security difficulty
- 136 SQLi Advanced — Dumping the Entire Database with UNIONExplain UNION SELECT's rule for combining two results (matching column counts)
- 137 Blind SQLi & sqlmap — Extracting Even When Nothing ShowsExplain the oracle (true/false answering device) principle of Boolean-based Blind SQLi
- 138 XSS Basics — Reflected & Stored, the Traitor Inside the BrowserExplain how XSS differs from SQL injection (the attack target is the browser)
- 140 CSRF: Request Forgery — The Victim's Browser Clicks for YouExplain how the browser's automatic cookie-sending trait enables CSRF
- 143 Command Injection — The Moment a Search Box Becomes the Server's TerminalFind command injection's two conditions (input concatenation + shell execution) in code
- 148 OWASP Juice Shop 1: Introduction to the Modern Web App — The Attack Stage Has ChangedExplain the structural difference between an SPA (single-page application) and a traditional web app
- 149 Juice Shop 2 — Access Control and IDORExplain the condition under which IDOR arises ("authenticates but doesn't authorize")
- 150 Juice Shop 3 — JWT and Business LogicBreak a JWT into its three chunks (header.payload.signature) and read its contents
- 151 Dreamhack Web Introduction — Your First Real ProblemsKnow the components of a Dreamhack wargame problem (title, description, URL, flag submission)
Before you move on
For each lab, record the request conditions, observed response, vulnerable processing and defensive approach. Check the platform rules and lesson prerequisites before moving to the next exercise.
Check each lesson’s setup and completion criteria. If you already know a section, start with the lessons you need.