Pick a subject on the map to see what it teaches, what it needs
first, and where it leads.
locked
free
advanced
web · ~5h
Web Server Config Semantics
The bugs live in the config. Read nginx and Apache the way the server actually resolves them.
Free — opens Edge & Infrastructure.
teaches
- nginx
- Apache
- Static handling
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
web · ~4h
Encoding & Charsets
The gap between what a filter reads and what the app decodes is an entire bypass class.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- UTF-8
- Unicode
- Best-fit / punycode
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
web · ~6h
Proxies, CDNs & Load Balancers
Every hop is a new parser and a new trust boundary. Learn which headers to believe and which to forge.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- L4 vs L7
- TLS termination
- Trust boundaries
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
expert
web · ~6h
WAF: How It Works & Fails
A WAF buys time; it is not a boundary. See how it parses a request, and how requests slip past it.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- CRS
- Parsing pipeline
- Bypass
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
web · ~3h
Regex & ReDoS
The language filters and validators are written in — and how one pattern hangs the whole service.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Regex
- Catastrophic backtracking
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
web · ~5h
Applied Crypto for Web
Concepts, not number theory: hashing vs encryption vs signing, and the oracles that break them.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Hash vs enc vs sign
- Padding oracle
- Randomness
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
foundations · ~5h
Linux & Containers for Security
After the foothold: permissions, processes, and how far a container escape really reaches.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Permissions
- Processes
- Container escape
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
expert
crypto · ~6h
Block Cipher Attacks
The attacks that come from how a block cipher is *used*, not broken: ECB's leaky determinism, CBC's malleability and padding oracles, and keystream reuse in CTR/stream modes.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- ECB patterns
- CBC padding
- Keystream reuse
before this
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
basic
forensics · ~6h
Network Forensics
Reading the story out of a packet capture: reconstructing files and credentials from cleartext protocols, following TCP streams, decrypting TLS with a key log, and spotting covert channels. All attachment challenges (ship a pcap, recover the flag).
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Reading captures
- Protocol analysis
- Covert channels
before this
Start this course →Free to create an account; sign in to begin.
locked
free
basic
web · ~5h
The Browser Security Model
The browser is the only thing standing between a page you opened and every other site you are logged into. By the end of this course you will be able to look at two URLs and say whether they are same-origin, same-site or cross-site, and say which browser rule cares about which. You will know exactly what the same-origin policy stops a page from reading, why it stops almost nothing from being sent, and what that asymmetry costs. You will be able to read a CORS exchange from a capture and say whether the browser handed the response to the page, spot a window message handler that trusts a sender it never checked, and read a Content-Security-Policy well enough to find the hole in it.
Free — a foundation: how things work.
teaches
- Origin vs site
- Same-origin policy
- DOM & postMessage
- CSP
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
crypto · ~5h
Crypto Basics
Start with no cryptography at all and finish able to look at an unfamiliar blob and say what it is — hex, base64, URL-encoded, a digest, a ciphertext — and get the bytes back where bytes can be got back. You will learn what a hash actually promises, why a fast hash is the wrong tool for a password and what a salt changes, and what a symmetric key, a block cipher and a mode each contribute — including the pattern ECB leaves in plain sight. You will see what a public key pair does when it encrypts and what it does when it signs, why encryption alone never proves who sent a message, and how to check a signature with one command. You will finish able to tell a random-looking value from an unpredictable one, which is the difference between a reset token that works and a reset token that is a vulnerability.
Free — a foundation: how things work.
teaches
- Encoding vs encryption
- Hashing
- Symmetric & public key
- Signing & randomness
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
basic
web · ~6h
How HTTP Really Works
You will read and write HTTP at the byte level. By the end you can take a raw request or response apart — start line, headers, the blank line, the body — type one yourself over a socket with no client to help you, and say exactly where one message ends and the next begins, whether it is framed by Content-Length, by chunked encoding or by the connection closing. You will know what the common status codes and methods promise, and how little of that a server is obliged to honour. You will read a URL the way a parser reads it — its parts, its percent-encoding, and the two spellings of one path that are the seed of a whole class of later bypasses.
Free — a foundation: how things work.
teaches
- Wire format
- Framing
- Methods & status
- URLs & encoding
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
basic
web · ~5h
Cookies & Sessions
HTTP forgets you between requests. This course shows exactly how a site remembers you anyway:
what a `Set-Cookie` header does to the browser, which cookies a given request actually carries,
and why cookie scope is a looser boundary than an origin — so a subdomain nobody was watching can
shadow the cookie your login depends on. You will then take a session apart: what a session id
must be, why it has to change at login, what session fixation is, and why clearing a cookie is
not the same as logging out. It ends with cross-site requests — what SameSite stops, what it
quietly does not, and the defences CSRF actually needs. Nine labs, all reading and reasoning
except the one where you fix a victim's session and ride it.
Free — a foundation: how things work.
teaches
- Cookies
- Cookie scope
- Sessions
- SameSite & CSRF
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
foundations · ~5h
Linux for Security
Open a terminal for the first time and finish able to work in one. You will move around a filesystem and read what is there, understand what a path is and who owns a file, read the permission bits well enough to spot the weak one, chain commands with pipes and redirection, and pull an answer out of a real access log with grep, sort, uniq and awk. You will also learn to see what a machine is running and what it is exposing, with ps, systemctl, ss and curl. Every example is a command you will repeat in later courses — searching a source tree, reading a log, checking what a binary is, following a suspicious process.
Free — a foundation: how things work.
teaches
- The shell
- Files & permissions
- Processes & services
- Searching text & logs
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
foundations · ~5h
Networking for Security
Everything you will attack later travels over a connection, and most of the interesting bugs live in the gap between what the wire carries and what software believes it carried. By the end of this course you will be able to read an address and say which network it belongs to, list what is listening on a machine and distrust the service names a scanner prints, explain why TCP delivers bytes rather than messages and find the exact byte where one HTTP request ends and the next begins, follow a DNS answer through its CNAMEs and spot a resolver that is lying, and read a certificate to see which names it covers — including the case where the name in the TLS handshake and the name in the HTTP request disagree.
Free — a foundation: how things work.
teaches
- Addresses, ports and connections
- TCP as a byte stream
- Where an HTTP message ends
- DNS lookups, records and caching
- TLS, certificates and SNI
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
foundations · ~5h
Reading Code for Bugs
Learn to open a codebase you have never seen and find the line that trusts the wrong thing. You will orient in an unfamiliar tree in minutes instead of hours, name what counts as attacker-controlled input and what counts as a dangerous sink, follow one value from a request to the call that parses it, and recognise the handful of sinks that matter in Python, JavaScript, PHP and Java. You will also learn to read a check for whether it is a check at all, and to read a diff for the bug it introduces. Eight labs, every one a source tree or a patch you read offline.
Free — a foundation: how things work.
teaches
- Reading an unfamiliar codebase
- Sources & sinks
- Taint tracking
- Reviewing a change
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
foundations · ~5h
SQL Basics
Start with no database experience at all and finish able to open a database file you have been handed, read its schema and write the query that answers a question about it. You will learn SELECT and WHERE, sorting and limiting, why NULL behaves unlike every other value, how an application's data ends up spread across tables and how joins put it back together, and how to summarise many rows with aggregates. The last module covers how a database describes itself, the handful of differences between SQLite, MySQL, PostgreSQL, MSSQL and Oracle that you will actually trip over, and UNION. Nine labs, each one a database file and a question only the right query answers.
Free — a foundation: how things work.
teaches
- SELECT & WHERE
- Joins & aggregates
- The schema itself
- Dialect differences
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~9h
Android Internals & Reversing
Take an Android app apart at every layer and put your changes back. You will decompile DEX to readable code, follow logic across multiple DEX files and through reflection, and read secrets out of resources and obfuscated strings. You will edit smali to patch a branch or force a return, then repackage and resign the app and run your own build. You will drop into native code — mapping JNI methods, reversing XOR'd strings, patching a .so and reading native arguments at runtime — and instrument a running app with Frida to hook methods, read private state and locate a check. Finally you will defeat the protections that fight all of this: ProGuard renaming, DexGuard string encryption, runtime-decrypting packers, dynamically loaded code and anti-decompiler tricks. The reversing craft every later Android lab assumes.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- DEX/smali reversing
- smali patching & resigning
- JNI / native triage
- Runtime hooking with Frida
- Deobfuscation & unpacking
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~9h
iOS Internals & Reversing
Read an iOS app the way its runtime does. You will map a Mach-O binary and its plists, dump the decrypted app from memory, and recover its shape with class-dump and Swift demangling. You will reverse iOS string obfuscation, patch an arm64 branch and resign the app, and read the Mach-O load-command tricks apps use to mislead tools. On a test device you will hook Objective-C and Swift methods, trace selectors, inject a dylib to instrument without a jailbreak, and explore a live app's objects — then dump Keychain items and recover data stored at the wrong protection class, and get past anti-analysis and stripped binaries. The iOS craft the platform's capability and resilience labs assume.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Mach-O & Swift internals
- App decryption & dumping
- arm64 patching & resigning
- Runtime hooking (ObjC/Swift)
- Anti-analysis recovery
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~7h
Mobile Authentication & Session
Break the assumptions a mobile app makes about who is calling. You will pull embedded API keys and tokens out of an app and replay them, and see why a token in local storage is a token you own. You will walk a mobile OAuth flow and steal an authorization code through an unclaimed custom scheme, intercept a code where PKCE is missing, and turn a missing state parameter into login CSRF. You will defeat biometric and MFA gates that live only on the client — forcing a result, hooking a success callback, or simply calling the endpoint the UI was guarding — and forge sessions that the backend never bound to a device. Throughout, the lesson is the same: the app decides nothing the server does not re-check.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Token storage & lifetime
- Mobile OAuth & PKCE
- Deep-link auth bypass
- Biometric & MFA bypass
- Mobile session handling
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~7h
Mobile Cryptography
Turn "the app encrypts it" back into "you can read it." You will find the keys apps ship in their own code, sitting beside the very data they protect, and forge tokens signed with a secret baked into the binary. You will exploit the classic mode and primitive mistakes — ECB's leaking patterns, a fixed IV, a reused GCM nonce, textbook RSA — and break the weak key-derivation and predictable randomness that make "random" tokens guessable. Then you will reach into the platform key stores: an Android Keystore key with no user-auth binding, a non-exportable key turned into a decryption oracle, a biometric gate decided in client code, and transport that accepts a weak cipher or no certificate check at all. By the end, "encrypted" is a claim you know how to test.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Key management flaws
- Cipher-mode & IV/nonce misuse
- Weak KDF & randomness
- Keystore/Keychain key binding
- Custom-crypto reversing
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
expert
mobile · ~10h
Dynamic Instrumentation & Tooling
Stop running other people's bypass scripts and start writing your own. You will build instrumentation from first principles with Frida: hook native functions with Interceptor to read and rewrite arguments and return values, replace functions outright, drive the Java runtime with Java.perform and Java.choose, and hook native code by symbol and by raw module offset when nothing is exported. You will scan and patch process memory, trace execution with Stalker to find the branch that matters, dump code a packer only decrypts in RAM, and log TLS keys. Then you will turn hooks into tools — rpc.exports driven from a host script, a reusable one-command bypass, a Frida gadget embedded when there is no root, hooks that fire early and stay hidden — and reach into Unity IL2CPP, Flutter and the Objective-C runtime. By the end you can instrument a target no public script covers.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Interceptor & Stalker
- Memory scan & patch
- Native hooking (symbol/offset)
- rpc.exports tooling
- Writing your own bypass tools
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~8h
Mobile Platform Interaction & IPC
Attack the app from the rest of the device. You will launch exported activities and services that were never meant to be reached, read and inject into content providers, and steal secrets from broadcasts. You will redirect intents through confused deputies, hijack mutable PendingIntents, and abuse deep links, App Links and iOS URL schemes and universal links to walk straight into gated actions. You will cross the WebView boundary — reaching native code through JavaScript bridges, reading local files, and pivoting in-app XSS to the bridge — and finish with the UI-level attacks: task hijacking, tapjacking overlays, accessibility abuse, and pasteboard leaks. The whole surface an app trusts from its neighbours, and how little of it is actually protected.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Exported components & providers
- Intents, broadcasts & PendingIntents
- Deep links, App Links & URL schemes
- WebView JavaScript bridges
- Tapjacking & accessibility abuse
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
expert
mobile · ~12h
Native & Hybrid Mobile
Go past the managed layer into the code most tools stop at. You will reverse JNI-heavy native libraries, recover logic from stripped binaries, and exploit real native memory-corruption — stack overflows, format strings, integer bugs and use-after-free — to steer a mobile app. Then you will take apart every major cross-platform framework the way its own toolchain does: extract Dart from a Flutter AOT snapshot and bypass its BoringSSL pinning, decompile React Native Hermes bytecode and patch a JS bundle, read Xamarin .NET assemblies and Unity IL2CPP metadata, and handle Kotlin/Native, Cordova and NativeScript. The deep end of mobile reversing, ending in a capstone that chains a framework, a native check and a backend.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Native / JNI reversing
- Mobile memory corruption
- Flutter (Dart AOT) reversing
- React Native / Hermes
- Xamarin & Unity reversing
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~7h
Mobile Network & API Abuse
Once you can see an app's traffic, its backend is just an API — and mobile apps trust their backends in ways web apps learned not to. You will intercept and replay requests, tamper the parameters the app assumed it controlled, and reach endpoints the UI never shows. You will attack the API's authorization the way the OWASP API Top-10 does — broken object- and function-level access, mass assignment, features gated by a response the client is trusted to check — and forge the HMAC the app signs its requests with using the key it ships. Then you will turn to the cloud backends behind modern apps: open Firebase rules, over-privileged API keys, an introspectable GraphQL schema, a WebSocket that skips a check, and a 2FA step the server forgot to enforce. By the end you can take an app's backend apart from the outside.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Interception, tampering & replay
- API authorization (BOLA/BFLA)
- Mass assignment & client-trusted gates
- Request-signature forgery
- Firebase, GraphQL, WebSocket & push abuse
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
basic
mobile · ~5h
Mobile Platform Fundamentals
Start with an app file you have never opened and finish able to take any mobile app apart. You will unzip an APK and an IPA and read what is inside — the manifest, the resources, the compiled code, the native libraries — decompile Android bytecode back to readable code, and find the secrets an app ships with. You will learn why the device in the user's hand is a client you cannot trust, set up an emulator and a proxy to watch an app talk to its backend, pull an app's private data off the device, and take your first look inside a running app with Frida. By the end you can pull, read, proxy and attach to a mobile app — the ground every later mobile course stands on.
Free — opens Mobile Application Security.
teaches
- App packaging & sandbox
- Static triage (decompile, strings)
- Permissions & attack surface
- Emulator & proxy setup
- First dynamic instrumentation
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
expert
mobile · ~12h
Mobile Resilience & Runtime Bypass
Every client-side control an app uses to stop you — root and jailbreak detection, emulator detection, SSL pinning, tamper and integrity checks, anti-debug and anti-instrumentation — defeated in more than one way. You will climb the same ladder for each control: first patch the check out of the app statically and repackage it, then leave the binary alone and hook the check at runtime with Frida, then beat a multi-signal or native version the easy hook misses, and finally get an instrumented result out of an app that is actively hunting your tools. You will bypass certificate pinning six ways, defeat Frida-detection, embed a gadget when there is no root, deobfuscate the check before you beat it, and finish by chaining a root check, pinning and anti-Frida to capture one server-side flag end to end. This is the course the whole domain is really about.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Root/jailbreak-detection bypass
- Emulator-detection bypass
- SSL-pinning bypass
- Integrity & tamper bypass
- Anti-debug & anti-instrumentation
- Dynamic instrumentation (Frida/Objection)
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
mobile · ~7h
Mobile Data Storage & Privacy
Find everything an app leaves behind. You will read the four places Android and iOS apps keep data — preferences, databases, the Keychain/Keystore and caches — and pull secrets straight out of them, then break the at-rest crypto wrappers (EncryptedSharedPreferences, SQLCipher) that were supposed to protect them, recovering the key the app hid nearby. You will chase the quieter leaks that MASVS v2 calls out on their own: values written to logs and crash reports, left on the clipboard, captured in the app-switcher snapshot, learned by the keyboard, cached by a WebView, exfiltrated by an analytics SDK, or swept into a cloud backup. By the end you can say exactly what data an app stores, where, and what of it should never have been there.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Android & iOS local stores
- At-rest crypto wrappers & their keys
- Log, crash and clipboard leakage
- Snapshot, keyboard & WebView caches
- Privacy & data minimization
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
mobile · ~6h
PWA Security
A progressive web app is a website that installs like a native app, and that power is its attack surface. You will read what a PWA leaves in browser storage and the Cache API — including data that should have gone at logout — and learn the service worker: the script that sits between the app and the network. You will abuse an over-broad scope, serve a stale authenticated page offline, poison the cache to make an XSS persist, and turn a permissive fetch handler into a client-side MITM. You will abuse the web app manifest, share and file handlers, push and background sync, and finish able to reason about every seam the installable web adds.
Free — opens Mobile Application Security.
teaches
- Service workers
- Offline cache poisoning
- Web app manifest & scope
- Push & background sync
- PWA client storage
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
ready to start
free
basic
osint · ~5h
Web & Infrastructure Recon
Turning a starting clue into an answer using only open sources: metadata, archived pages, certificate and DNS records, and exposed code. Attachment/static challenges — the flag is found, not exploited.
Free — opens Web App Security.
teaches
- Metadata
- Infrastructure recon
- Code and leaks
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
reversing · ~8h
Crackmes
The core reverse-engineering ladder: find and defeat a correctness check in a binary — from a plaintext comparison to transformed input, custom encodings, and simple bytecode. All attachment challenges (ship a binary, recover the flag).
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Locating the check
- Input transforms
- State and bytecode
before this
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~5h
Access Control & IDOR
Reaching data and functions you should not: insecure direct object references in every shape, vertical and horizontal privilege escalation, and the parameter, method, and path tricks that defeat a broken access-control layer.
Free — opens Web App Security, API Security.
teaches
- IDOR
- Privilege escalation
- Bypass mechanisms
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~5h
API Object & Function Authz
The OWASP API Top-10 view of access control, distinct from the page-oriented Access Control course: broken object-level authorization (BOLA) with sequential and leaked ids, broken function-level authorization (BFLA) via a swapped method or an undocumented endpoint, mass assignment of a role or a price, excessive data exposure in over-returned fields, a forgotten old API version that skips a newer check, and unbounded resource consumption.
Free — opens Web App Security.
teaches
- BOLA & BFLA
- Mass assignment
- Excessive data exposure
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~8h
Authentication
Breaking the front door: login weaknesses and enumeration, password-reset flaws, session-management mistakes, MFA bypasses, and forgeable authentication tokens.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Login weaknesses
- Password reset
- Session handling
- MFA bypass
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~7h
Business Logic
Breaking the rules the code assumes but never enforces: price and quantity tampering, coupon and rounding abuse, currency and overflow confusion, skipped workflow steps, replay and race double-spends, and the CAPTCHA checks that a server forgets to actually perform.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Business logic flaws
- Workflow abuse
- CAPTCHA bypass
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
expert
web · ~5h
Web Cache Poisoning & Deception
Turning a shared cache against the people it is meant to speed up. You will learn what a cache key is and how to tell a keyed input from an unkeyed one by reading X-Cache, Age, Vary and Cache-Control; poison a stored response through an unkeyed header, an unkeyed cookie and an internal header the front end was supposed to strip; exploit the discrepancies between how a cache and an origin key a request — the Host header, URL normalisation, a fat GET that hides a parameter in the body, and a Vary the cache ignores; and turn the same static-versus-dynamic confusion around to make a cache store a victim's private page and serve it to you — web cache deception.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Cache keys
- Unkeyed input poisoning
- Cache-key discrepancies
- Web cache deception
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
subscription · free during launch
advanced
web · ~3h
Clickjacking & UI Redressing
Framing a target the victim is logged into and stealing their clicks: the page that ships no X-Frame-Options or frame-ancestors at all; the X-Frame-Options that a modern browser ignores because it is the obsolete ALLOW-FROM; the frame-ancestors allowlist that names the attacker's own origin; the JavaScript frame-buster a sandboxed iframe silently defeats; and the redressed interactions — a two-click sequence, a form pre-filled from the URL, a drag that moves a secret, and a confirmation that fires only on a double-click. Every lab drives a real in-service logged-in victim that frames the target and performs the tricked gesture.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Clickjacking and UI redressing
- Framing defences and their gaps
- Redressed multi-step, drag and double-click interactions
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~5h
OS Command Injection
Making a web app run your commands on its own operating system: in-band, blind and time-based injection, the filter bypasses that defeat character and keyword blocklists (separators, spaces, keywords, newlines), argument injection into a called binary, and second-order payloads that fire far from where they were stored.
Free — opens Server-Side Security.
teaches
- Command injection
- Filter bypass
- Blind exploitation
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~4h
CORS Misconfiguration
Turning the same-origin policy inside out: a server that reflects the Origin it is handed and pairs it with credentials lets an attacker's page read a logged-in victim's private API data. Eight labs walk the ladder — plain reflected-origin-with-credentials and the trusted null origin, the wildcard that reads only what needs no credentials, the four ways an origin allow-list is walked past (a subdomain, an unanchored regex, a prefix and a suffix match), and the two that need a step more: a sensitive read that skips preflight, and an Access-Control header poisoned into a cache that forgot to vary on Origin.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- CORS misconfiguration
- Origin reflection with credentials
- Origin allow-list bypass
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~4h
Cross-Site Request Forgery (CSRF)
Making a logged-in victim's own browser send a state-changing request the attacker chose: the action with no token at all, the token that is present but never checked, not tied to the session, predictable, or leaked through a URL; the GET state-change a SameSite=Lax cookie still rides; the method-override, Referer-absent and JSON-with-text/plain bypasses; the double-submit cookie an attacker can plant; and login CSRF that logs the victim into the attacker's account. Every lab drives a real in-service logged-in victim.
Free — opens Client-Side Security.
teaches
- Cross-site request forgery
- CSRF token defenses and their gaps
- SameSite and content-type bypasses
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~6h
Insecure Deserialization
Turning attacker bytes back into live objects: a pickled session cookie that runs a command as it is loaded, a PHP object whose magic methods fire on unserialize, a POP gadget chain that reaches a shell, node-serialize and Ruby Marshal RCE, unsafe YAML, and the type juggling and blind detection that make deserialization exploitable even when nothing is echoed back.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Object injection
- Gadget chains
- Remote code execution
- Type juggling
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~7h
File Upload
Every way a file upload turns into code execution or worse: defeating extension, content-type and magic-byte checks, abusing server config and parsers, and racing the validator — from a first webshell to SVG XSS, XXE, zip-slip and TOCTOU.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Executing an upload
- Content checks
- Parser abuse
- Upload races
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
GraphQL API Security
Attacking a GraphQL API from the query language up: reading the schema through introspection, and recovering hidden fields from the server's own "did you mean" suggestions when introspection is off; the authorization gaps a single graph makes easy — object-level bypass through a node/id lookup, a hidden mutation callable without the required role, and over-fetch through a related field whose resolver never re-checks who is asking; and the query-layer abuse the language invites — rate-limit bypass by aliasing one field many times, a 2FA/rate bypass through query batching, injection through a resolver argument, denial of service via a deeply nested query, and a state-changing mutation served over GET that CSRF rides. Every lab is a real GraphQL endpoint whose per-environment flag only the intended flaw reaches.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- GraphQL introspection and schema disclosure
- GraphQL authorization gaps (BOLA/BFLA/over-fetch)
- GraphQL query-layer abuse (aliases, batching, injection, DoS)
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~4h
Information Disclosure
Finding the secrets a web app never meant to hand out: an exposed .git directory or .env file, source and backup files left in the web root, a directory listing, a JavaScript source map that rebuilds the original code, secrets buried in HTML/JS comments and response headers, verbose stack traces, and internal APIs reachable through a debug endpoint or an exposed Swagger document.
Free — opens Web App Security.
teaches
- Information disclosure
- Recon
- Secret recovery
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~6h
JWT & OAuth
Breaking the tokens that carry identity after login. On the JWT side: an accepted `alg:none`, a brute-forceable HMAC secret, expiry that is never checked, the RS256/HS256 key confusion that turns a public key into a signing secret, and the `kid`, `jku` and `x5u` header tricks that make the server verify with a key the attacker chose. On the OAuth side: a loose `redirect_uri` that leaks the authorization code, a missing `state` that opens login CSRF, an access token left in the open by the implicit flow, an authorization code that can be reused, scope granted that was never authorized, and a PKCE check quietly downgraded away. Every lab forges or steals a real token and turns it into account takeover.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- JWT verification flaws
- JWT header injection
- OAuth flow flaws
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
Local File Inclusion (LFI) to RCE
Turning an application that includes a file you name into arbitrary code execution: reading local files through a path parameter, defeating the ../ sanitisers and the legacy null-byte trick, disclosing source with php://filter, and the escalation paths to RCE — the modern php://filter chain, the data:// wrapper, log and /proc/self/environ poisoning, PHP session files, and the zip:// stream wrapper.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Local file inclusion
- Path traversal
- PHP wrappers
- LFI to RCE
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
NoSQL Injection
Turning a document-database query against the app that builds it: operator injection that logs you in as anyone ($ne/$gt), the array- and JSON-body tricks that smuggle those operators past a naive filter, breaking out of a hand-built query or aggregation pipeline, server-side JavaScript through $where, and the blind channels — boolean, $regex and time-based — that read a secret out one character at a time.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- NoSQL injection
- Operator injection
- Blind extraction
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~4h
Open Redirect
Turning a redirect the application controls into one an attacker controls: the unchecked return-URL parameter, the allow-list checks that a lookalike host, a protocol-relative prefix, a backslash or an extra layer of encoding all walk past, the client-side location sink, and the two chains that make it dangerous — CRLF header injection and the theft of an OAuth authorization code through a whitelisted-but-open callback.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Open redirect
- Redirect allow-list bypass
- Redirect-based chaining
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
free
advanced
web · ~5h
Path & Proxy Confusion
Make the proxy and the app read the same URL differently — and walk straight past the access-control check. When an edge ACL parses the request path one way and the application router builds its effective path another way, a request the edge believes is harmless still reaches a route the edge meant to block: dot-segment and encoded traversal, double-encoding, semicolon and matrix parameters, backslash and Unicode normalization, nginx alias traversal, rewrite-override headers, and trailing-slash routing confusion.
Free — opens Breaking HTTP.
teaches
- Normalization
- Path confusion
- HPP
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
Prototype Pollution
Writing to a shared JavaScript prototype through a key you were never meant to reach: the `__proto__` and `constructor.prototype` sinks in unsafe deep-merges, query-string and JSON parsers, on both the client and the Node server — and the gadgets that turn a polluted property into DOM XSS, an authorization bypass, and command execution.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Prototype pollution
- Gadget chains
- Filter bypass
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
Race Conditions
Winning the gap between a check and the write that should follow it: limit overruns that spend a one-time coupon twice, a balance driven negative by concurrent withdrawals, TOCTOU between a check and its use, two endpoints colliding on one pot of value, reading a half-built object mid-request, a single-packet burst that walks past a rate limiter to brute a 2FA code, a duplicate identity forced in at registration, and a weak per-session lock raced open. Every lab is a genuine concurrency flaw — the flag appears only once the collided state is real.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Race conditions
- Limit overrun
- TOCTOU
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
expert
web · ~8h
HTTP Request Smuggling
When the front-end proxy and the back-end origin disagree about where one request ends, you can hide a second request inside the first. CL.TE, TE.CL and TE.TE desync, HTTP/2 downgrade and CRLF injection, and what a desync buys an attacker: cache poisoning, response-queue poisoning and client-side desync.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- CL.TE / TE.CL
- TE.TE
- H2 downgrade
before this
on these learning paths
Create a free account →Not written yet — sign up to start with what is ready.
locked
free
advanced
web · ~10h
SQL Injection
Start with no SQL at all and finish by turning a query into a foothold on the host. You will see the query behind a page, bend it to reveal hidden data, read other tables with UNION, extract a secret one bit at a time when nothing is shown, and then learn the one fix that actually closes it. Thirty-five hands-on labs across MySQL, PostgreSQL, MSSQL, Oracle and SQLite.
Free — opens Server-Side Security.
teaches
- Reading a query
- SQL injection
- UNION & blind extraction
- Prepared statements
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~6h
Server-Side Request Forgery
Making the server make requests it should not: reaching localhost-only and internal endpoints, defeating allow-list filters with encoding and redirects, and pivoting via alternate schemes.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Reaching internal services
- Filter bypass
- Egress limits
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~6h
Server-Side Template Injection
User input that reaches a template engine as template source, not as data: detecting the flaw with a polyglot, evaluating expressions and reading server state, and driving Jinja2, Twig, Smarty, ERB, Handlebars, FreeMarker, and Velocity to code execution — then the harder cases of a template sandbox, a blind injection point, and a filtered context.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- SSTI detection
- Template engine exploitation
- Sandbox escape
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
Web LLM & Prompt Injection
Attacking applications that put a large language model in the request path: direct prompt injection and system-prompt extraction, indirect injection through retrieved data, RAG poisoning and markdown-image exfiltration, insecure handling of model output that becomes stored XSS, tool abuse and excessive agency, guardrail jailbreaks, and leaking the sensitive data the model was trusted with.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- Prompt injection
- Insecure output handling
- Tool & agency abuse
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~5h
WebSocket Security
Attacking the long-lived, full-duplex channel a page opens back to the server: the message fields a WebSocket handler trusts (SQL injection, stored XSS, command injection), the handshake a server forgets to check (cross-site WebSocket hijacking and origin spoofing), and the authorization gaps that appear when actions move off the REST API onto a socket (skipped auth, id tampering, and rate limits that only guard the HTTP door).
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- WebSocket security
- Origin validation
- Message-trust flaws
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~8h
Cross-Site Scripting (XSS)
Script running in the victim's browser, exhaustively: reflected and stored across every HTML/JS context, the full range of DOM sinks, breaking out of filters, and slipping past a Content-Security-Policy.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- XSS & DOM
- CSP bypass
- Clickjacking
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.
locked
subscription · free during launch
advanced
web · ~6h
XML External Entity (XXE)
Turning an XML parser against the server it runs on: declare an external entity and the parser reads a local file straight into the response, or into an error, or into a document you never see. Classic file reads across SVG, SOAP and content-type-switched endpoints; parameter entities, XInclude and PHP wrappers when the output is not handed back; and the entity-expansion denial of service a hardened parser is built to refuse.
Paid — teaches how to break things. Its first module and basic labs are free to try.
teaches
- External entities
- File retrieval
- Parameter entities
- Entity-expansion DoS
before this
on these learning paths
Start this course →Free to create an account; sign in to begin.