Expert-Led Courses
Structured learning paths built by elite hackers and engineers. 44 courses •
HTTP Request Smuggling
// VULNERABLE: Inconsistent Content-Length vs Transfer-Encoding parsing (CL.TE)
How Do Prototype Pollution Vulnerabilities Arise?
// VULNERABLE: Recursive merge without key sanitization (prototype pollution)
Independent Security Research Has Developed Several Deliberately Vulnerable Labs
// VULNERABLE: Cache deception — /account.js maps to /account (path confusion)
Insecure Direct Object References (IDOR)
Unauthorized access to objects through manipulation of direct references.
Limit Overrun Race Conditions
// VULNERABLE: Time-of-check to time-of-use (TOCTOU) on coupon/balance
OS Command Injection
// VULNERABLE: OS command injection via shell interpolation (Node.js)
Path Traversal
// VULNERABLE: Path traversal via unsanitized filename (Node/Express)
Server-Side Request Forgery (SSRF)
// VULNERABLE: SSRF via unvalidated URL fetch (Node)
Types of NoSQL Injection
// VULNERABLE: NoSQL operator injection (MongoDB)
Web Penetration Tester Masterclass
OWASP Top 10 deep-dive with real labs. Master SQLi, XSS, SSRF, SSTI, auth flaws, XXE, file inclusion, API hacking and modern WAF bypasses — with PortSwigger-style hands-on exercises.
WebSockets
// VULNERABLE: WebSocket handshake trusts Origin, no CSRF check
What Are Business Logic Vulnerabilities?
// VULNERABLE: Business logic flaw — negative quantity or race on coupon
What Are JWTs?
// VULNERABLE: JWT accepts 'none' alg + weak secret + no exp check
What Is Authentication?
// VULNERABLE: Direct use without allow-list
What Is Clickjacking?
// VULNERABLE: Direct use without allow-list
What Is Cross-Site Scripting?
Cross-site scripting (XSS) is a class of security vulnerability that occurs when an application includes untrusted data in its output without proper validation or encoding.
What Is Information Disclosure?
// VULNERABLE: Direct use without allow-list
What Is OAUTH?
// VULNERABLE: Direct use without allow-list
What Is SQL Injection?
SQL injection (SQLi) is a class of security vulnerability that occurs when an application includes untrusted data in a SQL query without proper sanitization or parameterization.
What Is Serialization? **Serialization** Is the Process of Converting Complex Da
// VULNERABLE: Direct use without allow-list