Explore Lessons
Interactive lessons covering the most common web security vulnerabilities.
- New
AI: Slop Squatting
- When AI tools hallucinate package names, attackers can register malicious packages with those names.
Broken Access Control
- All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.
Clickjacking
- As an application author, you need to be sure your users aren't having their clicks stolen by attackers.
Command Execution
- If your application calls out to the OS, you need to be sure command strings are securely constructed.
Cross-Site Request Forgery
- If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.
Directory Traversal
- Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.
Downgrade Attacks
- Attackers may be able to intercept, read and manipulate HTTPS traffic if you fail to specify a modern version of TLS.
File Upload Vulnerabilities
- File uploads are an easy way for an attacker to inject malicious code into your application.
Information Leakage
- Revealing system information helps an attacker learn about your tech stack.
Insecure Design
- Security begins before you start writing code.
Lax Security Settings
- Improper security settings are a common cause of vulnerabilities.
Logging and Monitoring
- Comprehensive logging and monitoring will tell you what your site is doing at runtime, which is key to spotting security events.
Mass Assignment
- Automatically unpacking data from the HTTP request can sometimes be too easy.
Open Redirects
- Most web-applications make use of redirects. If your site forwards to URLs supplied in a query string, you could be enabling phishing attacks.
Password Mismanagement
- Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong.
Privilege Escalation
- Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions.
Prototype Pollution
- If an attacker can access and modify prototype objects in JavaScript, you are in danger.
Regex Injection
- Regular expressions are frequently used in web-development, but can be abused by attackers.
Session Fixation
- Insecure treatment of session IDs can leave your users vulnerable to having their session hijacked.
SQL Injection
- If you are vulnerable to SQL Injection, attackers can run arbitrary commands against your database.
SSL Stripping
- If only some actions on your website require HTTPS, an attacker may be able to steal credentials for your users.
Server-Side Request Forgery
- An attacker can use SSRF vulnerabilities to probe your internal network
Toxic Dependencies
- Third-party libraries could be introducing vulnerabilities or malicious code into your system.
Unencrypted Communication
- Insufficient encryption can make you vulnerable to monster-in-the-middle attacks.
User Enumeration
- Leaking username information on your site makes things much easier for hackers.
Weak Session IDs
- Guessable session IDs make your website vulnerable to session hijacking.
XML Bombs
- Unsafe treatment of XML macros can make your server vulnerable to attack from specially crafted XML files.
XML External Entities
- Unsafe treatment of external references in XML allows an attacker to probe your file system for sensitive information.
DOM-based XSS
- If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript.
Reflected XSS
- When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server.
Cross-Site Scripting
- If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.