EXPLORE THE CURRICULUM
Your learning map
See how it fits together. Find the lesson you want to learn next.
44 lessons · Web security
Reset filtersL1How the web worksStep 71–766 lessons
- 071 HTML/CSS Basics — A Web Page's Skeleton and ClothesStarting from an empty file, build by hand a web page with a title, paragraphs, links, images, lists, and inpu…
- 072 JavaScript Basics — The Language That Brings Web Pages to LifeWrite basic JS syntax compared with Python (let/const, function, console.log)
- 073 Understanding HTTP Completely — The Web's Rules of ConversationLaunch a practice web server on your computer with python -m http.server
- 074 The requests Library — Talking to the Web with PythonBuild your own practice server (lab.py) in Python that understands POST and cookies
- 075 Crawling with BeautifulSoup — Pulling Only What You Want from HTMLTurn an HTML string into a navigable structure with BeautifulSoup(string, "html.parser")
- 076 Crawlers and Automation — A Collector That Works by Itself Every DayLaunch a local practice site with python -m http.server
L2Web security foundationsStep 131–15525 lessons
- 131 Build Your Own Web Server — Login and SessionsCreate accounts in a sqlite3 DB and implement login verification
- 132 Burp Suite 1: Intercepting with a Proxy — Slipping Between Browser and ServerExplain what a proxy does between a browser and a server
- 133 Burp Suite 2: Repeater and Intruder — The Repeat Experiment Bench and the Automatic Machine GunSend a caught request to Repeater and run repeated experiments
- 134 Cookie and Session Attacks — Shaking the ID Card the Server TrustsExplain the structure by which cookies and sessions maintain login state, at the request/response header level
- 135 DVWA Setup and SQLi Basics — Crossing Low and MediumLaunch DVWA with Docker and adjust its security difficulty
- 136 SQLi Advanced — Dumping the Entire Database with UNIONExplain UNION SELECT's rule for combining two results (matching column counts)
- 137 Blind SQLi & sqlmap — Extracting Even When Nothing ShowsExplain the oracle (true/false answering device) principle of Boolean-based Blind SQLi
- 138 XSS Basics — Reflected & Stored, the Traitor Inside the BrowserExplain how XSS differs from SQL injection (the attack target is the browser)
- 139 XSS Advanced: Cookie Theft & Filter Bypass — Beyond alert, Stealing SessionsWrite a real-world XSS payload that sends document.cookie to the attacker's server
- 140 CSRF: Request Forgery — The Victim's Browser Clicks for YouExplain how the browser's automatic cookie-sending trait enables CSRF
- 141 File Upload Attack: Web Shell — From a Board Post to Server TakeoverExplain what a web shell is and the chain by which "one upload" leads to "server takeover"
- 142 Web Shell Advanced: Writing Your Own & the Principles — Building the One-Line Door YourselfExplain a web shell's core structure (input → execute → output) line by line
- 143 Command Injection — The Moment a Search Box Becomes the Server's TerminalFind command injection's two conditions (input concatenation + shell execution) in code
- 144 File Inclusion: LFI/RFI — I Choose the File the Server "Reads for Me"Explain the difference between LFI and RFI in terms of how include works
- 145 Directory Busting & Information Exposure — The "If They Don't Know the Address, It's Safe" FallacyExplain the principle of forced browsing and the basic usage of gobuster
- 146 Authentication Attacks, Combined — Four Ways to Knock on the Front DoorExplain why a default-credential check is the "first five minutes" of a real penetration test
- 147 ★ DVWA All Difficulty Levels + the Three-Tier Summary Table — What It Means to "Completely" Know One VulnerabilityExplain at the code level how defense code evolves as DVWA's difficulty rises
- 148 OWASP Juice Shop 1: Introduction to the Modern Web App — The Attack Stage Has ChangedExplain the structural difference between an SPA (single-page application) and a traditional web app
- 149 Juice Shop 2 — Access Control and IDORExplain the condition under which IDOR arises ("authenticates but doesn't authorize")
- 150 Juice Shop 3 — JWT and Business LogicBreak a JWT into its three chunks (header.payload.signature) and read its contents
- 151 Dreamhack Web Introduction — Your First Real ProblemsKnow the components of a Dreamhack wargame problem (title, description, URL, flag submission)
- 152 Dreamhack Web (Cumulative 16) — Recognizing Techniques in DisguiseExplain how the same vulnerability hides in different features (search box, download, basket)
- 153 DreamHack Web (Running Total: 24) — Breaking Through with ResearchIdentify the tech stack (Flask, PHP, etc.) in a challenge and use it as search-keyword material
- 154 DreamHack Web (Running Total: 32) — Your Weakness List and Problem-Picking StrategyMaintain solve records in CSV format (date, problem name, type, minutes spent, result)
- 155 ★ Project — Independent Assault on a Vulnerable Web Target, with a ReportCarry out the recon → feature mapping → hypothesis → verification sequence on an unknown web target, on your o…
L3Advanced web securityStep 191–20212 lessons
- 191 PortSwigger Academy: Advanced SQLi — Blind, time-based, OOBDistinguish Blind SQLi's three oracles (true/false, time, OOB) by situation
- 192 Advanced XSS: CSP Bypass, DOM Deep Dive — Attacking Where Defenses ExistRead a CSP header's directives (script-src, 'self', etc.) and interpret their meaning
- 193 SSTI: Template Injection → RCE — When Your Input Becomes the Server's CodeExplain that SSTI shares the same root as SQL injection and XSS (input becomes code)
- 194 SSRF — Making the Server Your Proxy to Read the Internal NetworkExplain why SSRF arises from "features that send requests on your behalf"
- 195 XXE — The File-Reading Command Hidden in the XML ParserRead XML DOCTYPE and entity declaration syntax, and explain why external entities are dangerous
- 196 Deserialization Vulnerabilities — The Moment Data Becomes CodeExplain what serialization and deserialization are, and why deserialization leads to code execution
- 197 Advanced JWT Attacks — Becoming Admin via alg Confusion and Weak SecretsExplain the key-structure difference between HS256 (symmetric) and RS256 (asymmetric)
- 198 GraphQL/API Security — Enter Through One Door, Read the Whole SchemaRead the structure of a GraphQL query and explain how it differs from REST
- 199 Webhacking.kr 1–15 — The Korean Wargame Sampler PackRead Webhacking.kr's challenge list structure (points, solve counts) and gauge difficulty
- 200 Webhacking.kr 16–30 — Creative Combinations of TechniquesList a problem's "visible defenses," build a table of bypass candidates, and eliminate them
- 201 Race Conditions & HTTP Request Smuggling — Attacks of the Instant and the MisalignmentExplain the structure of TOCTOU (time-of-check to time-of-use) with a diagram
- 202 ★ Midterm Check: Solve Three Intermediate Web Challenges Independently in a Row — The No-Write-up ZoneApply challenge-selection criteria that keep the check fair (randomness, pre-blocking by type)